Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2011-4512: Siemens WinCC HMI web server allows crafted web requests to alter responses
CVE-2011-4512 · published 14 years ago
Summary
The web server used in several Siemens WinCC and Simatic HMI products can be tricked into adding custom information to the data they send back to browsers. This could let an attacker change what a user sees, steal session data, or embed malicious links. Apply the latest service packs or updates from Siemens to close the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| siemens | wincc_flexible |
2004 2005 2007 2008 cpe:2.3:a:siemens:wincc_flexible:2004:*:*:*:*:*:*:* |
| siemens | wincc |
<= v11 v11 cpe:2.3:a:siemens:wincc:*:sp2:*:*:*:*:*:* |
| siemens | simatic_hmi_panels |
comfort_panels mobile_panels mp op tp cpe:2.3:a:siemens:simatic_hmi_panels:comfort_panels:*:*:*:*:*:*:* |
| siemens | wincc_runtime_advanced |
v11 cpe:2.3:a:siemens:wincc_runtime_advanced:v11:*:*:*:*:*:*:* |
| siemens | wincc_flexible_runtime |
All versions
cpe:2.3:a:siemens:wincc_flexible_runtime:*:*:*:*:*:*:*:* |
Original advisory text
CRLF injection vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, a...
CRLF injection vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
References
- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_sec... Vendor Advisory
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdf US Government Resource
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
5.0
Medium
Type
CWE-94Code Injection
Timeline
Published3 Feb 2012
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2011-4512 · NVD
Track software like this
Free during beta