CVE Feed

    Dashboard / CVE / CVE-2012-2596

    CVE-2012-2596

    The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.

    Published:Jun 8, 2012
    Last Modified:Apr 11, 2025
    EPS:Jun 8, 2012
    EPSS Score:0.00241
    CVSS Score:5.5

    Affected Products

    Vendor
    Siemens
    Product
    Wincc

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-30897 (CVSS 7.8) — A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to…
    CVE-2017-12069 (CVSS 8.2) — An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Dis…
    CVE-2015-2822 (CVSS 4.3) — Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced be…
    CVE-2015-2823 (CVSS 6.8) — Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Pan…
    CVE-2015-1358 (CVSS 5) — The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in…
    CVE-2014-4686 (CVSS 6.8) — The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products…
    CVE-2014-4682 (CVSS 5) — The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote…
    CVE-2014-4685 (CVSS 4.6) — Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by…
    CVE-2014-4683 (CVSS 4.9) — The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote…
    CVE-2014-4684 (CVSS 6) — The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote aut…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High