CVE-2015-1355

Related Files

Siemens SIMATIC STEP 7 (TIA Portal) V13 Privilege Escalation

Posted Feb 16, 2015

Authored by Siemens ProductCERT | Site siemens.com

The latest update for SIMATIC STEP 7 (TIA Portal) V13 fixes two vulnerabilities. Device user passwords in TIA portal project files are stored using a weak hashing algorithm. Attackers with read access to the project file could possibly reconstruct the passwords for device users. Privilege information for device users is stored unprotected in the TIA portal projects. Attackers with access to the project file could possibly read and modify the permissions for device users in the project file. If unsuspecting users are tricked to download the manipulated project files to the device, the user permissions become active.

tags | advisory, vulnerability

advisories | CVE-2015-1355, CVE-2015-1356

SHA-256 | b243dfbab181ed3d05528d9c6f66e15488a6f9b74d9b5897afced4508f4b1aae

Download | Favorite | View