CVE-2014-2908
medium · 4.3A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVSS
20.9%
EPSS (exploit prob.)
97th
EPSS percentile
2014-04-25
Published
AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| siemens | simatic_s7_cpu_1200_firmware | 2.0 |
| siemens | simatic_s7_cpu_1200_firmware | 3.0 |
| siemens | simatic_s7_cpu_1200_firmware | 3.0.2 |
| siemens | simatic_s7_cpu-1211c | all versions |
| siemens | simatic_s7_cpu_1212c | all versions |
| siemens | simatic_s7_cpu_1214c | all versions |
| siemens | simatic_s7_cpu_1215c | all versions |
| siemens | simatic_s7_cpu_1217c | all versions |
Check a specific version with /api/v1/cve/match.
References
- http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
- https://www.exploit-db.com/exploits/44687/
- http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
- https://www.exploit-db.com/exploits/44687/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-2908