SSA-478960 V1.7 (Last Update: 2023-09-12): Missing CSRF Protection in the Web Server Login Page of Industrial Controllers

Risk Summary

<p>The web server login page of affected products does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack..</p> <p>Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.</p>

Remediations

• Refer to Siemens ProductCERT advisory for patch and remediation guidance.

Affected Vendors

Affected Products (1)