What is CVE-2016-8672?

CVE-2016-8672 is a medium-severity vulnerability in Siemens Simatic Cp 343-1, classified under Information Disclosure. CVSS score: 5.3/10. Published 2016-11-23.

How severe is CVE-2016-8672?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2016-8672 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Siemens Simatic Cp 343-1

CVE-2016-8672

A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission.

Vulnerability class: Information Disclosure

EPSS: 0.019 (77.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

f-secure-foundry/advisories

References

cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2016-8672?: CVE-2016-8672 is a medium-severity vulnerability in Siemens Simatic Cp 343-1, classified under Information Disclosure. CVSS score: 5.3/10. Published 2016-11-23.
How severe is CVE-2016-8672?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2016-8672 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.