Siemens SIMATIC S7-1500 CVE-2014-2248 Arbitrary URI Redirection Vulnerability

Bugtraq ID:	66190
Class:	Input Validation Error
CVE:	CVE-2014-2248
Remote:	Yes
Local:	No
Published:	Mar 12 2014 12:00AM
Updated:	Mar 19 2014 01:13AM
Credit:	Dmitry Serebryannikov, Ilya Karpov, Alexey Osipov, Yury Goltsev, Alex Timorin, Alexey Osipov, and Ilya Karpov from Positive Technologies
Vulnerable:
Not Vulnerable:

Siemens SIMATIC S7-1500 CVE-2014-2248 Arbitrary URI Redirection Vulnerability

Siemens SIMATIC S7-1500 is prone to an arbitrary URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits may redirect a user to a potentially malicious site, which may aid in phishing attacks.

Versions prior to Siemens SIMATIC S7-1500 1.5.0 are vulnerable.

Siemens SIMATIC S7-1500 CVE-2014-2248 Arbitrary URI Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Siemens SIMATIC S7-1500 CVE-2014-2248 Arbitrary URI Redirection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Siemens SIMATIC S7-1500 CVE-2014-2248 Arbitrary URI Redirection Vulnerability

References:

• Siemens Homepage (Siemens)