Vulnerabilities > CVE-2011-4515 - Credentials Management vulnerability in Siemens Wincc TIA Portal 11.0
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Siemens WinCC (TIA Portal) 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging (1) physical access or (2) Sm@rt Server access. Per http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf INSECURE PASWORD STORAGE User credentials for the HMI’s Web application are stored within the HMI’s system. These data are obfuscated in a reversible way and arereadable and writable for users with physical access or Sm@rt Server access to the system.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |