Denial of Service and Data Exposure in Siemens WinCC Versions

CVE-2011-4879

Summary

The miniweb.exe component of the Siemens WinCC flexible web server fails to process certain URI requests correctly, specifically those beginning with the 0xfa character. This oversight can allow attackers to exploit the vulnerability by sending specially crafted POST requests, potentially leading to unauthorized access to sensitive data or causing the application to crash, leading to denial of service. Affected versions include multiple iterations of WinCC flexible and WinCC V11, among others.

References