« Volver al listado

CVE-2016-8672

Estado: ModificadaMedia (5.3)—

A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Siemens — Simatic CP 343-1 FirmwareSiemens — Simatic CP 443-1 FirmwareSiemens — Simatic S7 300 CPU FirmwareSiemens — Simatic S7 400 CPU Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-8672",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-11-23T11:59:00.153",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-603476.pdf",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-603476.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the \"secure\" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en SIMATIC CP 343-1 Advanced (incluida la variante SIPLUS NET) (Todas las versiones  anteriores a la versión V3.0.53), SIMATIC CP 443-1 Advanced (incluida la variante SIPLUS NET) (Todas las versiones anteriores a la versión fV3.2.17), Familia de CPU SIMATIC S7-300 PN / DP (incluidas las variantes SIPLUS) (todas las versiones), familia de CPU SIMATIC S7-400 PN / DP (incluidas las variantes SIPLUS) (todas las versiones). El servidor web integrado entrega cookies sin la bandera \"segura\". Los navegadores modernos que interpretan la bandera mitigarían la posible fuga de datos en caso de transmisión de texto claro."
    }
  ],
  "lastModified": "2026-06-17T00:54:47.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:simatic_cp_343-1_firmware:-:*:*:*:advanced:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0332CA85-1B72-4008-8783-4ED53D1BF4BB"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:simatic_cp_343-1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C100D7C1-EAD2-455D-8A72-5BBBD85F2F77"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:simatic_s7_300_cpu_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84A8B1B4-3E6C-4F3C-A4E7-5712649EAD6C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7_300_cpu:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "97E70498-C935-4A82-9E93-52A650233669"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:simatic_s7_400_cpu_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B48BE7BE-828B-474A-B9EE-1C5423AB6A4F"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7_400_cpu:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "71991D50-56CB-4E92-B9B1-D018EA1A0022"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:simatic_cp_443-1_firmware:-:*:*:*:advanced:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FDE21BE-E8F0-4D6D-934E-5FF40B017B8B"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:simatic_cp_443-1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F58423D0-954E-426E-9F8F-3DD95FBDF50C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}