CVE:CVE-2011-4509
CNNVD:CNNVD-201112-423
Siemens SIMATIC HMI产品族是用作相应PLC和操作者之间的人机接口。
SIMATIC多个产品在实现上存在身份验证绕过漏洞。当使用非加密的HTTP通讯时，用户登录后可预测身份验证令牌/Cookie值集，攻击者可利用这些漏洞绕过目标安全限制并获取受影响应用的访问权限。
solution:Upgrade siemens wincc_flexible to a higher version than 2004,2005,2007,2008,and avoid the version 2004,2005,2007,2008; Upgrade siemens wincc to a higher version than v11,and avoid the version v11; Upgrade siemens simatic_hmi_panels to a higher version than comfort_panels,mobile_panels,mp,op,tp,and avoid the version comfort_panels,mobile_panels,mp,op,tp; Upgrade siemens wincc_runtime_advanced to a higher version than v11,and avoid the version v11; Upgrade siemens wincc_flexible_runtime to a higher version than *