What’s Vulnerable › Vulnerabilities

CVE-2012-3040

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-10-10 · updated 2026-06-16
• Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.

Affected products

• Siemens Simatic S7-1200 Cpu 1211C Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2
• Siemens Simatic S7-1200 Cpu 1212C Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2
• Siemens Simatic S7-1200 Cpu 1212Fc Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2
• Siemens Simatic S7-1200 Cpu 1214 Fc Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2
• Siemens Simatic S7-1200 Cpu 1214C Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2
• Siemens Simatic S7-1200 Cpu 1215 Fc Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2
• Siemens Simatic S7-1200 Cpu 1215C Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2
• Siemens Simatic S7-1200 Cpu 1217C Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2
• Siemens Simatic S7-1200 Firmware: from 2.0.0 before 3.0.2 — fixed in 3.0.2

How to fix

Upgrade to a fixed version: Siemens Simatic S7-1200 Cpu 1211C Firmware 3.0.2; Siemens Simatic S7-1200 Cpu 1212C Firmware 3.0.2; Siemens Simatic S7-1200 Cpu 1212Fc Firmware 3.0.2; Siemens Simatic S7-1200 Cpu 1214 Fc Firmware 3.0.2; Siemens Simatic S7-1200 Cpu 1214C Firmware 3.0.2; Siemens Simatic S7-1200 Cpu 1215 Fc Firmware 3.0.2; Siemens Simatic S7-1200 Cpu 1215C Firmware 3.0.2; Siemens Simatic S7-1200 Cpu 1217C Firmware 3.0.2; Siemens Simatic S7-1200 Firmware 3.0.2. Check the vendor advisory for mitigations.

References

• http://en.securitylab.ru/lab/PT-2012-50
• http://osvdb.org/86130
• http://secunia.com/advisories/50816
• http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-279823.pdf
• http://www.us-cert.gov/control_systems/pdf/ICSA-12-283-01.pdf
• http://en.securitylab.ru/lab/PT-2012-50
• http://osvdb.org/86130
• http://secunia.com/advisories/50816
• http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-279823.pdf
• http://www.us-cert.gov/control_systems/pdf/ICSA-12-283-01.pdf

Get alerted when CVE-2012-3040 or the next vulnerability affects your stack