GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2011-4877

Vulnerability from fkie_nvd - Published: 2012-02-03 20:55 - Updated: 2026-06-16 23:35
Severity
Summary
HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime, when Transfer Mode is enabled, allows remote attackers to cause a denial of service (application crash) by sending crafted data over TCP.
References
cret@cert.orghttp://aluigi.org/adv/winccflex_1-adv.txt
cret@cert.orghttp://www.exploit-db.com/exploits/18166
cret@cert.orghttp://www.osvdb.org/77382
cret@cert.orghttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdfVendor Advisory
cret@cert.orghttp://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02.pdf
cret@cert.orghttp://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02A.pdf
cret@cert.orghttp://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdfUS Government Resource
cret@cert.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/71451
af854a3a-2127-422b-91ae-364da2661108http://aluigi.org/adv/winccflex_1-adv.txt
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/18166
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/77382
af854a3a-2127-422b-91ae-364da2661108http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdfVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02.pdf
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02A.pdf
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdfUS Government Resource
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/71451
Impacted products
Vendor Product Version
siemens wincc_flexible 2004
siemens wincc_flexible 2005
siemens wincc_flexible 2007
siemens wincc_flexible 2008
siemens wincc v11
siemens simatic_hmi_panels comfort_panels
siemens simatic_hmi_panels mobile_panels
siemens simatic_hmi_panels mp
siemens simatic_hmi_panels op
siemens simatic_hmi_panels tp
siemens wincc_runtime_advanced v11
siemens wincc_flexible_runtime *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cret@cert.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:wincc_flexible:2004:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D596C29-36F8-44F2-897D-FD107769E5A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc_flexible:2005:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D84E29A-4BC2-4229-83C3-D9F7A641D19C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc_flexible:2007:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B3ADDE1-1F91-43E7-A3C3-3069916F4B23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc_flexible:2008:*:*:*:*:*:*:*",
              "matchCriteriaId": "1432EC7A-47B2-41D1-B90B-72DBB79AC266",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:wincc:v11:*:*:*:*:*:*:*",
              "matchCriteriaId": "18A9883B-80E1-4B2E-88DA-D2326AE3DC08",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:simatic_hmi_panels:comfort_panels:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC593746-B329-43EA-8CA1-AA56AC5A3B10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:simatic_hmi_panels:mobile_panels:*:*:*:*:*:*:*",
              "matchCriteriaId": "1DF877E8-A0D1-4444-99F2-8A3E8ED4D31B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:simatic_hmi_panels:mp:*:*:*:*:*:*:*",
              "matchCriteriaId": "442AC914-BDD5-4D0C-9E04-88F60EE2B730",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:simatic_hmi_panels:op:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9749966-1666-4F7D-90D0-17AFBB88AE83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:simatic_hmi_panels:tp:*:*:*:*:*:*:*",
              "matchCriteriaId": "9471D239-08B1-4076-82F7-2B73F4E343CE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:wincc_runtime_advanced:v11:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AE3AE80-C7A2-4581-993A-536936F6D315",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:wincc_flexible_runtime:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F785262-BBFB-4A0C-A7DC-97F5D6B94BB0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime, when Transfer Mode is enabled, allows remote attackers to cause a denial of service (application crash) by sending crafted data over TCP."
    },
    {
      "lang": "es",
      "value": "HmiLoad del cargador en tiempo de ejecuci\u00f3n (\"runtime loader\") de Siemens WinCC flexible 2004, 2005, 2007 y 2008; WinCC V11 (TIA portal); the TP, OP, MP, Comfort Panels y Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced y WinCC flexible Runtime, cuando el modo de transferencia (\"Transfer Mode\") est\u00e1 habilitado, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda de la aplicaci\u00f3n) enviando datos modificados sobre TCP."
    }
  ],
  "id": "CVE-2011-4877",
  "lastModified": "2026-06-16T23:35:33.663",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.1,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-02-03T20:55:01.983",
  "references": [
    {
      "source": "cret@cert.org",
      "url": "http://aluigi.org/adv/winccflex_1-adv.txt"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.exploit-db.com/exploits/18166"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.osvdb.org/77382"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdf"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02.pdf"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02A.pdf"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdf"
    },
    {
      "source": "cret@cert.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71451"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://aluigi.org/adv/winccflex_1-adv.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.exploit-db.com/exploits/18166"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/77382"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02A.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71451"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.