Siemens S7-1200 Web Application Cross Site Scripting

CVEs (1)

Remediations

• Siemens has released a security advisory SSA-27982, (https://cert-portal.siemens.com/productcert/pdf/ssa-279823.pdf) that details this vulnerability. It recommends users obtain the new updated firmware for Versions 3.0.0 and 3.0.1 of the S7-1200 by contacting Technical Support in their region: Germany: +49 (0) 911 895 7222, Americas: +1 423 262 5710, Asia-Pacific: +86 10 6475 7575
• Siemens also advises users who are unable to apply this firmware update to use the following mitigations: Disable JavaScript within the Web browser used to access the S7-1200 Web server. Utilize a modern Web browser with integrated XSS filtering mechanisms. Deactivate the S7-1200 Web server wherever possible.
• For this version of firmware (3.0.2), Siemens has also removed the HTTP PUT functionality, because it is not used by the S7-1200 Web server.

Affected Vendors

Affected Products (3)