Back to Database
Status published
High
CVE-2010-2772
Siemens Simatic WinCC and PCS 7 SCADA system uses a...
Vulnerability Description
Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stuxnet worm, a different vulnerability than CVE-2010-2568.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-2772
Credits & Attribution
No credits recorded in the NVD database.
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60587
- http://infoworld.com/d/security-central/siemens-warns-users-dont-change-passwords-after-worm-attack-915?sourcefssr
- http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=43876783&caller=viewhttp://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=43876783&c
- http://ics-cert.us-cert.gov/advisories/ICSA-12-205-01
- http://www.f-secure.com/weblog/archives/00001987.html
- http://www.automation.siemens.com/forum/guests/PostShow.aspx?PostID=16127&16127&Language=en&PageIndex=1
- http://www.vupen.com/english/advisories/2010/1893
- http://secunia.com/advisories/40682
- http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/
- http://www.sea.siemens.com/us/News/Industrial/Pages/WinCC_Update.aspx
- http://www.securityfocus.com/bid/41753
- http://infoworld.com/d/security-central/new-weaponized-virus-targets-industrial-secrets-725
- http://www.wilderssecurity.com/showpost.php?p=1712134&postcount=22
- http://www.wired.com/threatlevel/2010/07/siemens-scada/
More from siemens
View All →CVE-2023-39950
Insufficient input validation in efibootguard
Medium
6.1
CVE-2020-27632
In SIMATIC MV400 family versions prior to v7.0.6, the ISN...
High
7.5
CVE-2017-12069
An XXE vulnerability has been identified in OPC Foundation UA...
High
8.2
CVE-2017-11175
In J2 Innovations FIN Stack 4.0, the authentication webform is...
Medium
6.1
CVE-2016-8673
A vulnerability has been identified in SIMATIC CP 343-1 Advanced...
High
8.8
Affected Vendor
siemens
View all reports →Affected Software
simatic wincc, simatic pcs 7
Vulnerable Versions:
6.2, 7.0, 6.0, 6.1, 7.1
Timeline
Official Publish:
July 22nd, 2010
Last Modified:
August 7th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.