PT-2015-12: Privilege Gaining in Siemens SIMATIC WinCC (TIA Portal) Vulnerable softwareSiemens SIMATIC WinCC (TIA Portal) Version: 13 and earlierLink: http://www.siemens.com/Severity levelSeverity level: Medium Impact: Privilege Gaining Access Vector: Remote CVSS v2: Base Score: 6.8 Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)CVE: CVE-2014-4686Software descriptionSiemens SIMATIC WinCC (TIA Portal) is an engineering software to configure and program SIMATIC Panels, SIMATIC Industrial PCs, and Standard PCs running WinCC Runtime Advanced or SCADA System WinCC Runtime Professional visualization software.Vulnerability descriptionThe specialists of the Positive Research center have detected a Privilege Gaining vulnerability in Siemens SIMATIC WinCC (TIA Portal).Vulnerability exists due to a hard coded encryption key in WinCC RT Professional, which allows remote attackers to obtain sensitive information and escalate their privileges by sniffing network traffic.How to fixUpdate your sofware up to the latest versionAdvisory status 21.09.2012 - Vendor gets vulnerability details 13.02.2015 - Vendor releases fixed version and details 25.02.2015 - Public disclosureCreditsThe vulnerability was detected by Gleb Gritsai, Roman Ilin, Alexander Tlyapov, and Sergey Gordeychik, Positive Research Center (Positive Technologies Company)Referenceshttp://en.securitylab.ru/lab/PT-2015-12 http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf Reports on the vulnerabilities previously discovered by Positive Research:http://www.ptsecurity.com/research/advisory/ http://en.securitylab.ru/lab/