CRLF injection vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005…
Priority LOW 26CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
CRLF injection vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Why it matters now
EPSS 0.0161 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:wincc_flexible:2004:*:*:*:*:*:*:* | 2004 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc_flexible:2005:*:*:*:*:*:*:* | 2005 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc_flexible:2007:*:*:*:*:*:*:* | 2007 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc_flexible:2008:*:*:*:*:*:*:* | 2008 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc_flexible:2008:sp1:*:*:*:*:*:* | 2008 sp1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc_flexible:2008:sp2:*:*:*:*:*:* | 2008 sp2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc:*:sp2:*:*:*:*:*:* | up to v11 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc:v11:*:*:*:*:*:*:* | v11 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc:v11:sp1:*:*:*:*:*:* | v11 sp1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_hmi_panels:comfort_panels:*:*:*:*:*:*:* | comfort_panels | Vulnerable | Siemens |
- cpe:2.3:a:siemens:wincc_flexible:2004:*:*:*:*:*:*:* Versions 2004 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc_flexible:2005:*:*:*:*:*:*:* Versions 2005 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc_flexible:2007:*:*:*:*:*:*:* Versions 2007 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc_flexible:2008:*:*:*:*:*:*:* Versions 2008 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc_flexible:2008:sp1:*:*:*:*:*:* Versions 2008 sp1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc_flexible:2008:sp2:*:*:*:*:*:* Versions 2008 sp2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc:*:sp2:*:*:*:*:*:* Versions up to v11 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc:v11:*:*:*:*:*:*:* Versions v11 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc:v11:sp1:*:*:*:*:*:* Versions v11 sp1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_hmi_panels:comfort_panels:*:*:*:*:*:*:* Versions comfort_panels Vulnerable ·Siemens
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:simatic_hmi_panels:mobile_panels:*:*:*:*:*:*:* | mobile_panels | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_hmi_panels:mp:*:*:*:*:*:*:* | mp | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_hmi_panels:op:*:*:*:*:*:*:* | op | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_hmi_panels:tp:*:*:*:*:*:*:* | tp | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc_runtime_advanced:v11:*:*:*:*:*:*:* | v11 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:wincc_flexible_runtime:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
- cpe:2.3:a:siemens:simatic_hmi_panels:mobile_panels:*:*:*:*:*:*:* Versions mobile_panels Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_hmi_panels:mp:*:*:*:*:*:*:* Versions mp Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_hmi_panels:op:*:*:*:*:*:*:* Versions op Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_hmi_panels:tp:*:*:*:*:*:*:* Versions tp Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc_runtime_advanced:v11:*:*:*:*:*:*:* Versions v11 Vulnerable ·Siemens
- cpe:2.3:a:siemens:wincc_flexible_runtime:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2011-4512
- 2026-10-03 Alias added: GHSA-m278-843w-6753
References
More Siemens Simatic Hmi Panels vulnerabilities
- TI-2011-04195 Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible… CVSS 2.0HIGH 9.3
- TI-2011-04196 Directory traversal vulnerability in HmiLoad in the runtime loader in Siemens WinCC… CVSS 2.0HIGH 9.3
- TI-2011-04199 miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008… CVSS 2.0HIGH 8.5
- TI-2011-03885 Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP… CVSS 2.0HIGH 10.0
- TI-2011-03886 The TELNET daemon in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka… CVSS 2.0HIGH 10.0
- TI-2011-04198 Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC… CVSS 2.0HIGH 7.8
Sources
- CVE-2011-4512 · CVE Program
- CVE-2011-4512 · NVD
- FIRST EPSS
- GHSA-m278-843w-6753 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences