Vulnerabilidades do Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

Os dispositivos afetados não higienizam adequadamente os campos de comentário contidos em arquivos de trace importados antes de renderizá-los na página Trace. Isso pode permitir que um invasor engane por engenharia social um usuário autorizado que possua o direito de função “Read diagnostics” para que importe um arquivo de trace especialmente elaborado. A exploração bem-sucedida pode permitir que JavaScript controlado pelo atacante seja executado na sessão do navegador do usuário e realize operações de PLC por meio do servidor web, dentro do escopo da autorização do usuário.

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering an authorized user, who has the function right "Read diagnostics", to import a specially crafted trace file. The malicious trace file is insufficiently sanitized and malicious code could be executed in the clients browser session and trigger PLC operations via the webserver that the legitimate user is authorized to perform.