« Volver al listado

CVE-2013-3957

Estado: ModificadaAlta (7.5)—

SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Siemens — Simatic Pcs7Siemens — Wincc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-3957",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-06-14T19:55:01.233",
  "references": [
    {
      "url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345843.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345843.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, allows remote attackers to execute arbitrary SQL commands via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en la pantalla de login en el Web Navigator en Siemens WinCC anterior a 7.2 Update 1, utilizado en SIMATIC PCS7 8.0 SP1 y anteriores y sobre otros productos, permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-16T23:56:05.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:simatic_pcs7:*:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0165209F-7378-4C05-9373-ECA6EA57697D",
              "versionEndIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:siemens:simatic_pcs7:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8B894F4-9635-4436-BC0A-E43280426017"
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74484B5D-121B-4838-9072-019532E78A03",
              "versionEndIncluding": "7.2"
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A33F9015-7058-419A-8762-CB2AE4ACF1A7"
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc:7.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6271FCC-CCF6-4D31-801A-B4B0DC4639DD"
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc:7.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF7A6B2B-D573-4285-B3B4-136F2BE7E710"
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc:7.0:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "111D0F4D-2B67-46E8-BF8D-5D30EFE561EE"
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc:7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B16BB99-49E0-443E-BEE0-C7694D2C54E1"
            },
            {
              "criteria": "cpe:2.3:a:siemens:wincc:7.1:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4115260-50FC-40C9-81CF-4D9F97394627"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}