Siemens SIMATIC STEP 7 TIA Portal Password Hash Algorithm Security Weakness
BID:72695
Info
Siemens SIMATIC STEP 7 TIA Portal Password Hash Algorithm Security Weakness
| Bugtraq ID: | 72695 |
| Class: | Design Error |
| CVE: |
CVE-2015-1602 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 19 2015 12:00AM |
| Updated: | Feb 19 2015 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Siemens Simatic Step 7 TIA Portal V13 SP1 Siemens Simatic Step 7 TIA Portal V13 Siemens Simatic Step 7 TIA Portal V12 |
| Not Vulnerable: |
Siemens Simatic Step 7 TIA Portal V13 SP1 Upd1 |
Discussion
Siemens SIMATIC STEP 7 TIA Portal Password Hash Algorithm Security Weakness
Siemens SIMATIC STEP 7 TIA Portal is prone to a security weakness due to insecure password-hash algorithm.
Local attackers can exploit this issue to perform brute-force attacks and obtain user passwords which may aid in further attacks.
Versions prior to Siemens SIMATIC STEP 7 TIA Portal V13 SP1 Upd1 are vulnerable.
Siemens SIMATIC STEP 7 TIA Portal is prone to a security weakness due to insecure password-hash algorithm.
Local attackers can exploit this issue to perform brute-force attacks and obtain user passwords which may aid in further attacks.
Versions prior to Siemens SIMATIC STEP 7 TIA Portal V13 SP1 Upd1 are vulnerable.
Exploit / POC
Siemens SIMATIC STEP 7 TIA Portal Password Hash Algorithm Security Weakness
An attacker can exploit this issue using readily available tools.
An attacker can exploit this issue using readily available tools.
Solution / Fix
Siemens SIMATIC STEP 7 TIA Portal Password Hash Algorithm Security Weakness
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.