CVE-2012-2596

Name: CVE-2012-2596
Creator: NVD / NIST
Published: 2012-06-08T18:55:02.22+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.50%

Last modified Jun 16, 2026

CVE-2012-2596 is a vulnerability of currently unknown severity. The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.. EPSS estimates a 1.50% chance of exploitation in the next 30 days.

Description

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.

Metrics

EPSS Probability

1.50%

71.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-94

Affected Software

Vendor	Product	Versions	Update
Siemens	Wincc	7.0	Sp3

References

http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdfVendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdfUS Government Resource
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdfVendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdfUS Government Resource

Timeline

Published: Jun 8, 2012
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2012-2596?

How severe is CVE-2012-2596?

Severity scoring for CVE-2012-2596 is pending analysis. The EPSS model estimates a 1.50% probability of exploitation in the next 30 days.

How do I fix CVE-2012-2596?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-2596?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST