CVE-2017-12069 XML external entity in n/a
An attacker can exploit an XML External Entity vulnerability in the OPC Discovery Server to access arbitrary resources via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12069?
CVE-2017-12069 is a high-severity vulnerability in n/a, published on 30 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 (All versions V8.1 and earlier), SIMATIC WinCC (All versions < V7.4 SP1), SIMATIC WinCC Runtime Professional (All versions < V14 SP1), SIMATIC NET PC Software, and SIMATIC IT Production Suite. By sending specially crafted packets to the OPC Discovery Server at port 4840/tcp, an attacker might cause the system to access various resources chosen by the attacker.
Weakness: CWE-611
Which versions are affected by CVE-2017-12069?
It affects 4 products.
Products include Ocpfoundation Local Discovery Server, Ocpfoundation Ua .Net, Siemens Simatic Pcs7, Siemens Wincc.
How do I fix CVE-2017-12069?
No fix has been published for CVE-2017-12069 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-12069 being exploited?
There is no known exploitation of CVE-2017-12069 in the wild and no public exploit code.
Sources
Also known as GHSA-jj7f-wqmm-8q5f.