Siemens SIMATIC WinCC is prone to an HTTP-header-injection issue, a directory-traversal issue, and an arbitrary memory-read access issue because the application fails to properly sanitize user- supplied input. A remote attacker can exploit these issues to gain elevated privileges, obtain sensitive information, or cause denial-of-service conditions.

Updates are available. Please see the references for more information.

• http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/scada/Pages/Default.aspx
• http://www.securityfocus.com/bid/51836
• http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdf
• http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01A.pdf

---

Updated on 2015-03-25