A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15…
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V14), SIMATIC WinCC Runtime Advanced (All versions < V14), SIMATIC WinCC Runtime Professional (All versions < V14), SIMATIC WinCC (TIA Portal) (All versions < V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
https://cwe.mitre.org/data/definitions/113.html →Open in CWE collection →This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.
https://capec.mitre.org/data/definitions/31.html →Open in CAPEC collection →https://capec.mitre.org/data/definitions/34.html →Open in CAPEC collection →
This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on. The knowledge gained through Ajax fingerprinting can be used to support other attacks, such as XSS.
https://capec.mitre.org/data/definitions/85.html →Open in CAPEC collection →https://capec.mitre.org/data/definitions/105.html →Open in CAPEC collection →
| Product | Vendor | Status |
|---|---|---|
| simatic_hmi_comfort_outdoor_panels_firmware | * | Tracked |
| simatic_hmi_comfort_panels_firmware | * | Tracked |
| simatic_hmi_ktp_mobile_panels_ktp400f_firmware | * | Tracked |
| simatic_hmi_ktp_mobile_panels_ktp700_firmware | * | Tracked |
| simatic_hmi_ktp_mobile_panels_ktp700f_firmware | * | Tracked |
| simatic_hmi_ktp_mobile_panels_ktp900_firmware | * | Tracked |
| simatic_hmi_ktp_mobile_panels_ktp900f_firmware | * | Tracked |
| simatic_hmi_mp_firmware | * | Tracked |
| simatic_hmi_op_firmware | * | Tracked |
| simatic_hmi_tp_firmware | * | Tracked |
| simatic_wincc_(tia_portal) | * | Tracked |
| simatic_wincc_runtime | * | Tracked |