CVE-2016-8672: Infoleak
First published: Wed Nov 23 2016(Updated: )
A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Simatic CP 343-1 | ||
| Siemens Simatic CP 343-1 Advanced | ||
| Siemens SIMATIC S7-300 CPU | ||
| Siemens SIMATIC S7-300 CPU | ||
| Siemens SIMATIC S7-400 CPU | ||
| Siemens SIMATIC S7-400 CPU | ||
| Siemens SIMATIC CP 443-1 Std Firmware | ||
| Siemens Simatic CP443-1 Advanced Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2016-8672?
The severity of CVE-2016-8672 is classified as high due to its potential to allow unauthorized access.
How do I fix CVE-2016-8672?
To fix CVE-2016-8672, update the affected software to the latest versions as specified by Siemens.
Which versions are affected by CVE-2016-8672?
CVE-2016-8672 affects all versions of SIMATIC CP 343-1 Advanced below V3.0.53 and SIMATIC CP 443-1 Advanced below V3.2.17.
What products are impacted by CVE-2016-8672?
CVE-2016-8672 impacts products including the SIMATIC CP 343-1 Advanced, SIMATIC CP 443-1 Advanced, and the S7-300 and S7-400 PN/DP CPU families.
Is there a patch available for CVE-2016-8672?
Yes, a patch is available for CVE-2016-8672 that can be obtained by updating to the recommended software versions from Siemens.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens simatic cp 343-1
- canonical/siemens simatic cp 343-1 advanced
- canonical/siemens simatic s7-300 cpu
- canonical/siemens simatic s7-400 cpu
- canonical/siemens simatic cp 443-1 std firmware
- canonical/siemens simatic cp443-1 advanced firmware