CVE-2013-0670
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Siemens SIMATIC WinCC是德国西门子（Siemens）公司的一套自动化的数据采集与监控（SCADA）系统。该系统提供过程监视、数据采集等功能。 Siemens WinCC (TIA Portal) 11版本中的HMI web应用程序中存在CRLF注入漏洞。通过特制的URL，远程攻击者利用该漏洞注入任意HTTP头以及进行HTTP响应拆分攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2013-0670
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Siemens WinCC HMI web CRLF注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Siemens SIMATIC WinCC是德国西门子（Siemens）公司的一套自动化的数据采集与监控（SCADA）系统。该系统提供过程监视、数据采集等功能。 Siemens WinCC (TIA Portal) 11版本中的HMI web应用程序中存在CRLF注入漏洞。通过特制的URL，远程攻击者利用该漏洞注入任意HTTP头以及进行HTTP响应拆分攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2013-0670
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2013-0670
请登录查看更多情报信息。
Other References for CVE-2013-0670 (2)
-
-
🔗 http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf x_refsource_MISC
Same Patch Batch · n/a · 2013-03-21 · 27 CVEs total
| CVE-2013-0674 | Siemens WinCC RegReader ActiveX控件缓冲区溢出漏洞 | |
| CVE-2013-0672 | Siemens WinCC HMI web 跨站脚本漏洞 | |
| CVE-2013-0671 | Siemens WinCC 目录遍历漏洞 | |
| CVE-2013-0669 | Siemens WinCC HMI web 拒绝服务漏洞 | |
| CVE-2013-0668 | Siemens WinCC HMI web 多个跨站脚本漏洞 | |
| CVE-2013-0667 | Siemens WinCC HMI web 跨站脚本漏洞 | |
| CVE-2013-0665 | SEL AcSELerator QuickSet 本地访问绕过漏洞 | |
| CVE-2011-4515 | Siemens SIMATIC WinCC TIA Portal 敏感信息漏洞 | |
| CVE-2013-0679 | Siemens WinCC web服务器目录遍历漏洞 | |
| CVE-2013-0678 | Siemens WinCC 敏感信息漏洞 | |
| CVE-2013-0677 | Siemens WinCC web服务器拒绝服务漏洞 | |
| CVE-2013-0676 | Siemens WinCC 敏感信息漏洞 | |
| CVE-2013-0675 | Siemens WinCC CCEServer 缓冲区溢出漏洞 | |
| CVE-2013-0123 | ASKIA askiaweb 多个SQL注入漏洞 | |
| CVE-2013-0287 | SSSD Simple Access Provider ‘simple_deny_groups’访问控制绕过漏洞 | |
| CVE-2013-2279 | 多款CA SiteMinder产品SAML声明签名验证漏洞 | |
| CVE-2013-1427 | lighttpd 不安全临时文件创建漏洞 | |
| CVE-2013-1052 | Ubuntu ‘pam-xdg-support’模块本地权限提升漏洞 | |
| CVE-2013-1051 | apt 欺骗漏洞 | |
| CVE-2013-0453 | IBM Tivoli Endpoint Manager Web Reports 跨站脚本漏洞 |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2013-0670
No comments yet