1. CVE-Search
  2. CVE-2017-12069
ID CVE-2017-12069
Summary An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 (All versions V8.1 and earlier), SIMATIC WinCC (All versions < V7.4 SP1), SIMATIC WinCC Runtime Professional (All versions < V14 SP1), SIMATIC NET PC Software, and SIMATIC IT Production Suite. By sending specially crafted packets to the OPC Discovery Server at port 4840/tcp, an attacker might cause the system to access various resources chosen by the attacker.
References
Vulnerable Configurations
  • cpe:2.3:a:siemens:simatic_pcs7:7.1:sp3:*:*:*:*:*:*
    cpe:2.3:a:siemens:simatic_pcs7:7.1:sp3:*:*:*:*:*:*
  • cpe:2.3:a:siemens:simatic_pcs7:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:simatic_pcs7:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:simatic_pcs7:8.0:sp1:*:*:*:*:*:*
    cpe:2.3:a:siemens:simatic_pcs7:8.0:sp1:*:*:*:*:*:*
  • cpe:2.3:a:siemens:simatic_pcs7:8.1:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:simatic_pcs7:8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:5.0:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:5.0:sp1:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:5.0:sp1:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:6.0:sp2:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:6.0:sp2:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:6.0:sp3:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:6.0:sp3:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:6.0:sp4:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:6.0:sp4:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:7.0:sp1:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:7.0:sp1:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:7.0:sp2:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:7.0:sp2:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:7.0:sp3:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:7.0:sp3:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:7.1:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:7.1:sp1:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:7.1:sp1:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:7.2:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:siemens:wincc:7.3:*:*:*:*:*:*:*
    cpe:2.3:a:siemens:wincc:7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ocpfoundation:local_discovery_server:*:*:*:*:*:*:*:*
    cpe:2.3:a:ocpfoundation:local_discovery_server:*:*:*:*:*:*:*:*
  • cpe:2.3:a:ocpfoundation:ua_.net:*:*:*:*:*:*:*:*
    cpe:2.3:a:ocpfoundation:ua_.net:*:*:*:*:*:*:*:*
CVSS
Base: 6.4 (as of 06-10-2017 - 01:29)
Impact:
Exploitability:
CWE CWE-611
CAPEC
  • XML External Entities Blowup
    This attack takes advantage of the entity replacement property of XML where the value of the replacement is a URI. A well-crafted XML document could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:P
refmap via4
bid 100559
confirm
sectrack 1039510
Last major update 06-10-2017 - 01:29
Published 30-08-2017 - 19:29
Last modified 06-10-2017 - 01:29
Back to Top