CVE-2012-3037

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-09-25 · updated 2026-06-16
Weakness: CWE-295

Description

The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate.

Affected products

Siemens Simatic S7-1200 Cpu 1211C Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0
Siemens Simatic S7-1200 Cpu 1212C Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0
Siemens Simatic S7-1200 Cpu 1212Fc Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0
Siemens Simatic S7-1200 Cpu 1214 Fc Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0
Siemens Simatic S7-1200 Cpu 1214C Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0
Siemens Simatic S7-1200 Cpu 1215 Fc Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0
Siemens Simatic S7-1200 Cpu 1215C Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0
Siemens Simatic S7-1200 Cpu 1217C Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0
Siemens Simatic S7-1200 Firmware: from 2.0.0 before 3.0.0 — fixed in 3.0.0

How to fix

Upgrade to a fixed version: Siemens Simatic S7-1200 Cpu 1211C Firmware 3.0.0; Siemens Simatic S7-1200 Cpu 1212C Firmware 3.0.0; Siemens Simatic S7-1200 Cpu 1212Fc Firmware 3.0.0; Siemens Simatic S7-1200 Cpu 1214 Fc Firmware 3.0.0; Siemens Simatic S7-1200 Cpu 1214C Firmware 3.0.0; Siemens Simatic S7-1200 Cpu 1215 Fc Firmware 3.0.0; Siemens Simatic S7-1200 Cpu 1215C Firmware 3.0.0; Siemens Simatic S7-1200 Cpu 1217C Firmware 3.0.0; Siemens Simatic S7-1200 Firmware 3.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2012-3037 or the next vulnerability affects your stack