Vulnerability Details CVE-2011-4512
CRLF injection vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 58.7%
CVSS Severity
CVSS v2 Score 5.0
References
- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdf
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdf
- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdf
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdf
Products affected by CVE-2011-4512
-
cpe:2.3:a:siemens:simatic_hmi_panels:comfort_panels
-
cpe:2.3:a:siemens:simatic_hmi_panels:mobile_panels
-
cpe:2.3:a:siemens:simatic_hmi_panels:mp
-
cpe:2.3:a:siemens:simatic_hmi_panels:op
-
cpe:2.3:a:siemens:simatic_hmi_panels:tp
-
cpe:2.3:a:siemens:wincc:6.0
-
cpe:2.3:a:siemens:wincc:7.0
-
cpe:2.3:a:siemens:wincc:v11
-
cpe:2.3:a:siemens:wincc_flexible:2004
-
cpe:2.3:a:siemens:wincc_flexible:2005
-
cpe:2.3:a:siemens:wincc_flexible:2007
-
cpe:2.3:a:siemens:wincc_flexible:2008
-
cpe:2.3:a:siemens:wincc_flexible_runtime:*
-
cpe:2.3:a:siemens:wincc_runtime_advanced:v11