Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2011-4510: Siemens WinCC HMI web server lets attackers run scripts
CVE-2011-4510 · published 14 years ago
Summary
The web server built into several Siemens WinCC and Simatic HMI products can be tricked into executing malicious code that a remote user supplies. An attacker could inject harmful web scripts or HTML, which might let them view or change information displayed on the control screens. Apply the latest security updates from Siemens for the listed products as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| siemens | wincc_flexible |
2004 2005 2007 2008 cpe:2.3:a:siemens:wincc_flexible:2004:*:*:*:*:*:*:* |
| siemens | wincc |
<= v11 v11 cpe:2.3:a:siemens:wincc:*:sp2:*:*:*:*:*:* |
| siemens | simatic_hmi_panels |
comfort_panels mobile_panels mp op tp cpe:2.3:a:siemens:simatic_hmi_panels:comfort_panels:*:*:*:*:*:*:* |
| siemens | wincc_runtime_advanced |
v11 cpe:2.3:a:siemens:wincc_runtime_advanced:v11:*:*:*:*:*:*:* |
| siemens | wincc_flexible_runtime |
All versions
cpe:2.3:a:siemens:wincc_flexible_runtime:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfo...
Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4511.
References
- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_sec... Vendor Advisory
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdf US Government Resource
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
4.3
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Feb 2012
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2011-4510 · NVD
Track software like this
Free during beta