Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2011-4878 — Path Traversal in Siemens Wincc

CWE-22 — Path Traversal6 documents5 sources
Severity
7.8HIGHNVD
EPSS
15.1%
top 5.41%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Siemens WinccSiemens Simatic HMI PanelsSiemens Wincc Flexible+1 more
Timeline
PublishedFeb 3
Latest updateMay 17

Description

Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to read arbitrary files via a ..%5c (dot dot backslash) in a URI.

CVSS vector

AV:N/AC:L/C:C/I:N/A:NExploitability: 10.0 | Impact: 6.9

Affected Packages4 packages

▶NVDsiemens/wincc_flexible4 versions+3
▶NVDsiemens/winccv11+1
▶NVDsiemens/simatic_hmi_panels5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-hcgx-xc4m-9h7x: Directory traversal vulnerability in miniweb↗2022-05-17
▶
CVEList
CVE-2011-4878: Directory traversal vulnerability in miniweb↗2012-02-03
▶

💥Exploits & PoCs

3
Exploit-DB
FlatnuX CMS - Traversal Arbitrary File Access↗2012-04-01
▶
Exploit-DB
Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities↗2011-11-28
▶
Nuclei
FlatnuX CMS - Directory Traversal
▶
CVE-2011-4878 — Path Traversal in Siemens Wincc | cvebase