Sign-up

ID

VAR-201306-0315


CVE

CVE-2013-3958


TITLE

Siemens SIMATIC WinCC/PCS 7 Hardcoded Credential Security Bypass Vulnerability

Trust: 0.8

sources: IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-07606

DESCRIPTION

The login implementation in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, has a hardcoded account, which makes it easier for remote attackers to obtain access via an unspecified request. Siemens SIMATIC WinCC is a monitoring control and data acquisition SCADA and human machine interface HMI system. Siemens SIMATIC PCS is a process control system. An attacker can exploit the vulnerability to gain access. The vulnerability is due to the fact that the program has hard-coded accounts

Trust: 2.7

sources: NVD: CVE-2013-3958 // JVNDB: JVNDB-2013-002983 // CNVD: CNVD-2013-07606 // BID: 60561 // IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d // VULHUB: VHN-63960

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-07606

AFFECTED PRODUCTS

vendor:siemensmodel:simatic pcs7scope:eqversion:8.0

Trust: 1.6

vendor:siemensmodel:winccscope:eqversion:7.1

Trust: 1.6

vendor:siemensmodel:winccscope:eqversion:7.0

Trust: 1.6

vendor:siemensmodel:winccscope:lteversion:7.2

Trust: 1.0

vendor:siemensmodel:simatic pcs7scope:lteversion:8.0

Trust: 1.0

vendor:winccmodel: - scope:eqversion:7.0

Trust: 0.8

vendor:siemensmodel:simatic pcs 7scope:lteversion:8.0 sp1

Trust: 0.8

vendor:siemensmodel:simatic winccscope:ltversion:7.2 update 1

Trust: 0.8

vendor:siemensmodel:simatic winccscope:eqversion:7.x

Trust: 0.6

vendor:siemensmodel:simatic pcsscope:eqversion:78.x

Trust: 0.6

vendor:siemensmodel:winccscope:eqversion:7.2

Trust: 0.6

vendor:winccmodel: - scope:eqversion:7.1

Trust: 0.4

vendor:simatic pcs7model: - scope:eqversion:8.0

Trust: 0.2

vendor:simatic pcs7model: - scope:eqversion:*

Trust: 0.2

vendor:winccmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-07606 // JVNDB: JVNDB-2013-002983 // CNNVD: CNNVD-201306-248 // NVD: CVE-2013-3958

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-3958
value: HIGH

Trust: 1.0

NVD: CVE-2013-3958
value: HIGH

Trust: 0.8

CNVD: CNVD-2013-07606
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201306-248
value: HIGH

Trust: 0.6

IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

VULHUB: VHN-63960
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2013-3958
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-07606
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-63960
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-07606 // VULHUB: VHN-63960 // JVNDB: JVNDB-2013-002983 // CNNVD: CNNVD-201306-248 // NVD: CVE-2013-3958

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.9

sources: VULHUB: VHN-63960 // JVNDB: JVNDB-2013-002983 // NVD: CVE-2013-3958

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201306-248

TYPE

Trust management

Trust: 0.8

sources: IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201306-248

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-002983

PATCH
title:SSA-345843: Vulnerabilites in WinCC 7.2url:http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345843.pdf
Trust: 0.8
title:\302\240Siemens SIMATIC WinCC/PCS 7 Hardcoded Credential Security Bypass Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/34666
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-07606 // 
            
            
            
            JVNDB: JVNDB-2013-002983

EXTERNAL IDS
db:NVDid:CVE-2013-3958
Trust: 3.6
db:SIEMENSid:SSA-345843
Trust: 1.7
db:SECUNIAid:53805
Trust: 1.2
db:BIDid:60561
Trust: 1.0
db:CNNVDid:CNNVD-201306-248
Trust: 0.9
db:CNVDid:CNVD-2013-07606
Trust: 0.8
db:ICS CERTid:ICSA-13-169-02
Trust: 0.8
db:JVNDBid:JVNDB-2013-002983
Trust: 0.8
db:IVDid:E69A1CA0-2352-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-63960
Trust: 0.1
sources:
            
            
            IVD: e69a1ca0-2352-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2013-07606 // 
            
            
            
            VULHUB: VHN-63960 // 
            
            
            
            BID: 60561 // 
            
            
            
            JVNDB: JVNDB-2013-002983 // 
            
            
            
            CNNVD: CNNVD-201306-248 // 
            
            
            
            NVD: CVE-2013-3958

REFERENCES
url:http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345843.pdf
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3958
Trust: 0.8
url:https://ics-cert.us-cert.gov/advisories/icsa-13-169-02
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-3958
Trust: 0.8
url:http://secunia.com/advisories/53805/
Trust: 0.6
url:http://secunia.com/advisories/53805
Trust: 0.6
url:http://subscriber.communications.siemens.com/
Trust: 0.3
url:http://aunz.siemens.com/newscentre/productreleases/pages/iac_pr_simaticwinccv62.aspx
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2013-07606 // 
            
            
            
            VULHUB: VHN-63960 // 
            
            
            
            BID: 60561 // 
            
            
            
            JVNDB: JVNDB-2013-002983 // 
            
            
            
            CNNVD: CNNVD-201306-248 // 
            
            
            
            NVD: CVE-2013-3958

CREDITS
Alexander Tlyapov from Positive Technologies
Trust: 0.3
sources:
            
            
            BID: 60561

SOURCES
db:IVDid:e69a1ca0-2352-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-07606
db:VULHUBid:VHN-63960
db:BIDid:60561
db:JVNDBid:JVNDB-2013-002983
db:CNNVDid:CNNVD-201306-248
db:NVDid:CVE-2013-3958

LAST UPDATE DATE
2024-11-23T21:45:40.059000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-07606date:2013-06-19T00:00:00
db:VULHUBid:VHN-63960date:2013-06-17T00:00:00
db:BIDid:60561date:2013-06-19T07:17:00
db:JVNDBid:JVNDB-2013-002983date:2013-06-25T00:00:00
db:CNNVDid:CNNVD-201306-248date:2013-06-21T00:00:00
db:NVDid:CVE-2013-3958date:2024-11-21T01:54:37.307

SOURCES RELEASE DATE
db:IVDid:e69a1ca0-2352-11e6-abef-000c29c66e3ddate:2013-06-19T00:00:00
db:CNVDid:CNVD-2013-07606date:2013-06-19T00:00:00
db:VULHUBid:VHN-63960date:2013-06-14T00:00:00
db:BIDid:60561date:2013-06-14T00:00:00
db:JVNDBid:JVNDB-2013-002983date:2013-06-18T00:00:00
db:CNNVDid:CNNVD-201306-248date:2013-06-18T00:00:00
db:NVDid:CVE-2013-3958date:2013-06-14T19:55:01.250