Unscored severity · published Aug 1, 2013
CVE-2013-4911
Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wincc · Siemens
11.0; 11.0; 11.0; 12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4911
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4911
scadastrangelove.blogspot.com
http://scadastrangelove.blogspot.com/2013/08/ssa-064884-wincctia-portal-fixes.html
secunia.com
http://secunia.com/advisories/54051
secunia.com
http://secunia.com/advisories/54252
www.securityfocus.com
http://www.securityfocus.com/bid/61536
Vendor Advisory
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-064884.pdf
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/86099
More from Wincc
8.2
CVE-2017-12069
An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367
7.8
CVE-2023-30897
A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13)
–
CVE-2015-2823
Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC WinCC Runtime…
–
CVE-2015-2822
Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2 allow man-in-the-middle attackers…
–
CVE-2015-1358
The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4)…