CVE-2011-4509

Published: Feb 3, 2012Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime has an improperly selected default password for the administrator account, which makes it easier for remote attackers to obtain access via a brute-force approach involving many HTTP requests.

Affected (12)

Products: Siemens: Wincc Flexible, Wincc, Simatic Hmi Panels, Wincc Runtime Advanced, Wincc Flexible Runtime

5 products

Wincc Runtime Advanced

Wincc Flexible Runtime

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Siemens Wincc Flexible	Version 2004
Siemens Wincc Flexible	Version 2005
Siemens Wincc Flexible	Version 2007
Siemens Wincc Flexible	Version 2008

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Siemens Wincc	Version v11

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Siemens Simatic Hmi Panels	Version comfort_panels
Siemens Simatic Hmi Panels	Version mobile_panels
Siemens Simatic Hmi Panels	Version mp
Siemens Simatic Hmi Panels	Version op
Siemens Simatic Hmi Panels	Version tp