CVE-2010-2772 Hardcoded credentials in n/a

What is CVE-2010-2772?

CVE-2010-2772 is a high-severity vulnerability in n/a, published on 22 Jul 2010. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stuxnet worm, a different vulnerability than CVE-2010-2568.

Weakness: CWE-798

Which versions are affected by CVE-2010-2772?

It affects 2 products.

Products include Siemens Simatic Pcs 7, Siemens Simatic Wincc.

How do I fix CVE-2010-2772?

No fix has been published for CVE-2010-2772 yet. Limit exposure of the affected software until one is available.

Is CVE-2010-2772 being exploited?

There is no known exploitation of CVE-2010-2772 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-25910 Code injection in SIMATIC PCS 7 Critical 10.0
• CVE-2021-40358 Path traversal in SIMATIC PCS 7 V8.2 Critical 9.9
• CVE-2019-10922 Auth bypass in SIMATIC PCS 7 V8.0 and earlier Critical 9.8
• CVE-2021-40360 Information disclosure in SIMATIC PCS 7 V8.2 High 8.8
• CVE-2019-10916 SQL injection in SIMATIC PCS 7 V8.0 and earlier High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q89m-g397-f55p.