CVE-2016-8672: Infoleak
A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8672?
The severity of CVE-2016-8672 is classified as high due to its potential to allow unauthorized access.
How do I fix CVE-2016-8672?
To fix CVE-2016-8672, update the affected software to the latest versions as specified by Siemens.
Which versions are affected by CVE-2016-8672?
CVE-2016-8672 affects all versions of SIMATIC CP 343-1 Advanced below V3.0.53 and SIMATIC CP 443-1 Advanced below V3.2.17.
What products are impacted by CVE-2016-8672?
CVE-2016-8672 impacts products including the SIMATIC CP 343-1 Advanced, SIMATIC CP 443-1 Advanced, and the S7-300 and S7-400 PN/DP CPU families.
Is there a patch available for CVE-2016-8672?
Yes, a patch is available for CVE-2016-8672 that can be obtained by updating to the recommended software versions from Siemens.