You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
An official website of the United States government
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
NIST has updated the
NVD program announcement page with additional information regarding
recent concerns and the temporary delays in enrichment efforts.
CVE-2016-7165
Detail
Modified
This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.
Current Description
A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Production Suite (All versions < V7.0 SP1 HFX 2), SIMATIC NET PC-Software (All versions < V14), SIMATIC PCS 7 V7.1 (All versions), SIMATIC PCS 7 V8.0 (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2), SIMATIC STEP 7 V5.X (All versions < V5.5 SP4 HF11), SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced (All versions < V14), SIMATIC WinCC (TIA Portal) Professional V13 (All versions < V13 SP2), SIMATIC WinCC (TIA Portal) Professional V14 (All versions < V14 SP1), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1), SIMATIC WinCC V7.0 SP2 and earlier versions (All versions < V7.0 SP2 Upd 12), SIMATIC WinCC V7.0 SP3 (All versions < V7.0 SP3 Upd 8), SIMATIC WinCC V7.2 (All versions < V7.2 Upd 14), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 11), SIMATIC WinCC V7.4 (All versions < V7.4 SP1), SIMIT V9.0 (All versions < V9.0 SP1), SINEMA Remote Connect Client (All versions < V1.0 SP3), SINEMA Server (All versions < V13 SP2), SOFTNET Security Client V5.0 (All versions), Security Configuration Tool (SCT) (All versions < V4.3 HF1), TeleControl Server Basic (All versions < V3.0 SP2), WinAC RTX 2010 SP2 (All versions), WinAC RTX F 2010 SP2 (All versions). Unquoted service paths could allow local Microsoft Windows operating system users to escalate their privileges if the affected products are not installed under their default path ("C:\Program Files\*" or the localized equivalent).
Unquoted Windows search path vulnerability in Siemens SIMATIC WinCC before 7.0 SP2 Upd 12, 7.0 SP3 before Upd 8, and 7.2 through 7.4; SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced before 14; SIMATIC WinCC Runtime Professional; SIMATIC WinCC (TIA Portal) Professional; SIMATIC STEP 7 5.x; SIMATIC STEP 7 (TIA Portal) before 14; SIMATIC NET PC-Software before 14; TeleControl Server Basic before 3.0 SP2; SINEMA Server before 13 SP2; SIMATIC PCS 7 through 8.2; SINEMA Remote Connect Client; SIMATIC WinAC RTX 2010 SP2; SIMATIC WinAC RTX F 2010 SP2; SIMATIC IT Production Suite; SOFTNET Security Client 5.0; SIMIT 9.0; Security Configuration Tool (SCT); and Primary Setup Tool (PST), when the installation does not use the %PROGRAMFILES% directory, might allow local users to gain privileges via a Trojan horse executable file.
NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.
Note: NVD Analysts have published a CVSS score for this CVE based on publicly available information at the time of analysis. The CNA has not provided a score within the CVE List.
NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.
Note: NVD Analysts have published a CVSS score for this CVE based on publicly available information at the time of analysis. The CNA has not provided a score within the CVE List.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to nvd@nist.gov.
Unquoted Windows search path vulnerability in Siemens SIMATIC WinCC V7.0 SP2 before Upd 12, V7.0 SP3 before Upd 8, V7.2 before Upd 14, V7.3 before Upd 11, and V7.4 before SP1; SIMATIC STEP 7 V5.x before V5.5 SP4 HF11; SIMATIC PCS 7 through V8.2; SIMATIC WinCC Runtime Professional V13 before SP2 and V14 before SP1; SIMATIC WinCC (TIA Portal) Professional V13 before SP2 and V14 before SP1; SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced before 14; SIMATIC STEP 7 (TIA Portal) V13 before SP2; SI
Unquoted Windows search path vulnerability in Siemens SIMATIC WinCC V7.0 SP2 before Upd 12, V7.0 SP3 before Upd 8, V7.2 before Upd 14, V7.3 before Upd 11 and V7.4 before SP1; SIMATIC STEP 7 V5.x before V5.5 SP4 HF11; SIMATIC PCS 7 through V8.2; SIMATIC WinCC Runtime Professional V13 before SP2 and V14 before SP1; SIMATIC WinCC (TIA Portal) Professional V13 before SP2 and V14 before SP1; SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced before 14; SIMATIC STEP 7 (TIA Portal) V13 before SP2; SIM
Unquoted Windows search path vulnerability in Siemens SIMATIC WinCC V7.0 SP2 before Upd 12, V7.0 SP3 before Upd 8, V7.2 before Upd 14, V7.3 before Upd 11, and V7.4 before SP1; SIMATIC STEP 7 V5.x before V5.5 SP4 HF11; SIMATIC PCS 7 through V8.2; SIMATIC WinCC Runtime Professional V13 before SP2 and V14 before SP1; SIMATIC WinCC (TIA Portal) Professional V13 before SP2 and V14 before SP1; SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced before 14; SIMATIC STEP 7 (TIA Portal) V13 before SP2; SI
Unquoted Windows search path vulnerability in Siemens SIMATIC WinCC before 7.0 SP2 Upd 12, 7.0 SP3 before Upd 8, and 7.2 through 7.4; SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced before 14; SIMATIC WinCC Runtime Professional; SIMATIC WinCC (TIA Portal) Professional; SIMATIC STEP 7 5.x; SIMATIC STEP 7 (TIA Portal) before 14; SIMATIC NET PC-Software before 14; TeleControl Server Basic before 3.0 SP2; SINEMA Server before 13 SP2; SIMATIC PCS 7 through 8.2; SINEMA Remote Connect Client; SIMAT
Unquoted Windows search path vulnerability in Siemens SIMATIC WinCC V7.0 SP2 before Upd 12, V7.0 SP3 before Upd 8, V7.2 before Upd 14, V7.3 before Upd 11 and V7.4 before SP1; SIMATIC STEP 7 V5.x before V5.5 SP4 HF11; SIMATIC PCS 7 through V8.2; SIMATIC WinCC Runtime Professional V13 before SP2 and V14 before SP1; SIMATIC WinCC (TIA Portal) Professional V13 before SP2 and V14 before SP1; SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced before 14; SIMATIC STEP 7 (TIA Portal) V13 before SP2; SIM
Modified Analysis by NIST1/03/2017 1:01:21 PM
Action
Type
Old Value
New Value
Changed
Reference Type
http://securityaffairs.co/wordpress/53266/security/cve-2016-7165-siemens.html No Types Assigned
http://securityaffairs.co/wordpress/53266/security/cve-2016-7165-siemens.html Third Party Advisory
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
