CVE-2014-4686

Vulnerability

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, contains a hardcoded encryption key that is identical across installations [1]. An attacker who extracts this key from one product installation can use it to decrypt network traffic on TCP port 1030 [1].

Exploitation

An attacker needs network access to sniff traffic on TCP port 1030, but does not require authentication or physical access. The attacker must first obtain the hardcoded encryption key, which can be extracted from any other installation of the same WinCC version (before 7.3) [1]. Once the key is obtained, the attacker can passively decrypt all captured communications on that port [1].

Impact

Successful exploitation leads to disclosure of sensitive information transmitted between WinCC components over TCP port 1030 [1]. The confidentiality of the wincc system is compromised, potentially exposing project configuration data, credentials, or automation process information [1].

Mitigation

Siemens released SIMATIC WinCC version 7.3, which removes the hardcoded encryption key and implements proper key management [1]. Users should upgrade to WinCC 7.3 or later. No workaround is provided by the vendor for versions before 7.3 [1].