CVE-2012-3040
Estado: ModificadaMedia (4.3)—
Cross-site scripting (XSS) vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.56%
- Percentil entre todas las CVEs puntuadas: 85
- Fecha de la puntuación: 1/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
Siemens — Simatic S7-1200 CPU 1211c FirmwareSiemens — Simatic S7-1200 CPU 1212c FirmwareSiemens — Simatic S7-1200 CPU 1212fc FirmwareSiemens — Simatic S7-1200 CPU 1214 FC FirmwareSiemens — Simatic S7-1200 CPU 1214c FirmwareSiemens — Simatic S7-1200 CPU 1215 FC FirmwareSiemens — Simatic S7-1200 CPU 1215c FirmwareSiemens — Simatic S7-1200 CPU 1217c FirmwareSiemens — Simatic S7-1200 Firmware
CWE
- CWE-79
Referencias
- http://en.securitylab.ru/lab/PT-2012-50
- http://osvdb.org/86130
- http://secunia.com/advisories/50816
- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-279823.pdf
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-283-01.pdf
- http://en.securitylab.ru/lab/PT-2012-50
- http://osvdb.org/86130
- http://secunia.com/advisories/50816
- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-279823.pdf
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-283-01.pdf
JSON original (NVD)
Mostrar
{
"id": "CVE-2012-3040",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "ics-cert@hq.dhs.gov",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2012-10-10T18:55:02.080",
"references": [
{
"url": "http://en.securitylab.ru/lab/PT-2012-50",
"tags": [
"Third Party Advisory"
],
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "http://osvdb.org/86130",
"tags": [
"Broken Link"
],
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "http://secunia.com/advisories/50816",
"tags": [
"Third Party Advisory"
],
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-279823.pdf",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-283-01.pdf",
"tags": [
"Broken Link",
"Third Party Advisory",
"US Government Resource"
],
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "http://en.securitylab.ru/lab/PT-2012-50",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/86130",
"tags": [
"Broken Link"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/50816",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-279823.pdf",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-283-01.pdf",
"tags": [
"Broken Link",
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el servidor web SIMATIC S7-1200 PLCs v2.x hasta v3.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una URI específicamente construida."
}
],
"lastModified": "2026-06-16T23:42:33.030",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D6784CC-7FD8-4CD5-979F-0B9F62CE4AA3",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EC545350-FD53-4B2E-886F-E20F12260C9B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_cpu_1211c_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90523ED2-CE36-4287-9D80-4A508DBD6E17",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200_cpu_1211c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3871C0C9-C65E-4E0B-9CA8-75E60066297F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_cpu_1212c_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D31C744-AD8E-4E72-9E3E-F9ED8EFE2D8A",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200_cpu_1212c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "07849777-92E7-41D2-9128-F8D20DE15391"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_cpu_1212fc_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7EF332E-0725-44BB-8233-66B017D9DB20",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200_cpu_1212fc:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "68B3573B-A31E-4489-B2DD-B01B5C1D03CB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_cpu_1214_fc_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30F62D4A-8014-4B82-B219-37385F902436",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200_cpu_1214_fc:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B640800C-9263-4BEA-9DA5-1323932540BD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_cpu_1214c_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "021DC100-8C4D-452B-93E1-952AD9DA0954",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200_cpu_1214c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FE17584A-BF7A-48B8-A9CB-477663766C63"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_cpu_1215_fc_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6058C37-D10F-498B-80A6-E6608BCAF793",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200_cpu_1215_fc:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "76C7D55C-8D99-4E2F-A254-1BDE2B12A203"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_cpu_1215c_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8339C357-7788-4D44-9075-CA3FFB837453",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200_cpu_1215c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CC4698CF-F935-4707-BA91-7E3650C7956C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_s7-1200_cpu_1217c_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D1B4F7D-D7A6-4E79-9EE1-211394B37AA7",
"versionEndExcluding": "3.0.2",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_s7-1200_cpu_1217c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "232279DE-CF1C-4A3C-886D-B4CE3F104F09"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov"
}