CVE-2012-2596: siemens wincc Code Injection

Vulnerability summary

CVE-2012-2596 is a medium (CVSS 5.5) Code Injection vulnerability in siemens wincc. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.6% of scored vulnerabilities.

Timeline

1. 08-06-2012
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.