CVE-2017-12069: XEE
First published: Wed Aug 30 2017(Updated: )
An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 (All versions V8.1 and earlier), SIMATIC WinCC (All versions < V7.4 SP1), SIMATIC WinCC Runtime Professional (All versions < V14 SP1), SIMATIC NET PC Software, and SIMATIC IT Production Suite. By sending specially crafted packets to the OPC Discovery Server at port 4840/tcp, an attacker might cause the system to access various resources chosen by the attacker.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens SIMATIC PCS 7 | <=8.1 | |
| Siemens WinCC | <=7.4 | |
| OPC Foundation Local Discovery Server | <=1.01.333.0 | |
| opc.foundation UA .NET | <=2017-03-21 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-12069?
CVE-2017-12069 has a medium severity rating due to its exploitation potential through XML external entities.
How do I fix CVE-2017-12069?
To mitigate CVE-2017-12069, upgrade affected products to versions later than those specified in the vulnerability description.
Which products are affected by CVE-2017-12069?
CVE-2017-12069 affects Siemens SIMATIC PCS7 versions up to 8.1, Siemens WinCC versions below 7.4 SP1, OPC Foundation UA .NET before 2017-03-21, and Local Discovery Server versions before 1.03.367.
What type of vulnerability is CVE-2017-12069?
CVE-2017-12069 is classified as an XML External Entity (XXE) vulnerability.
Can CVE-2017-12069 be exploited remotely?
Yes, CVE-2017-12069 can potentially be exploited remotely if an attacker can send specially crafted XML data.
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/type
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- agent/author
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens simatic pcs 7
- version/siemens simatic pcs 7/8.1
- canonical/siemens simatic wincc
- version/siemens simatic wincc/7.4
- vendor/ocpfoundation
- canonical/opc foundation local discovery server
- version/opc foundation local discovery server/1.01.333.0
- canonical/opc.foundation ua .net
- version/opc.foundation ua .net/2017-03-21