CVE-2012-3032

Vulnerability

Siemens WinCC 7.0 SP3 and earlier, including versions used in SIMATIC PCS7 and other products, contain a SQL injection vulnerability in the WebNavigator component. The vulnerability is triggered when a remote attacker sends a specially crafted SOAP message to the WebNavigator service. No authentication is required to reach the vulnerable code path.

Exploitation

An attacker can exploit this vulnerability by sending a malicious SOAP message to the WebNavigator service over the network. The attacker does not need prior authentication or user interaction. The crafted message includes SQL injection payloads that are not properly sanitized, allowing the attacker to inject arbitrary SQL commands.

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands against the underlying database. This can lead to unauthorized disclosure of sensitive data, modification of database contents, and potentially further compromise of the affected system. The attacker gains the ability to manipulate the database at the privilege level of the WinCC application.

Mitigation

Siemens has published a security advisory (SSA-864051) [1] addressing this vulnerability. Users should upgrade to a fixed version of WinCC as specified in the advisory. No workarounds are documented in the provided reference. If upgrading is not immediately possible, network segmentation and restricting access to the WebNavigator service to trusted hosts can reduce risk.