Independent researchers Gleb Gritsai, Alexander Zaitsev, Sergey Scherbel, Yuri Goltsev, Dmitry Serebryannikov, Sergey Bobrov, Denis Baranov, Andrey Medov from Positive Technologies have identified multiple vulnerabilities in the Siemens WinCC application. In evaluating these reported vulnerabilities, Siemens identified an additional vulnerability that is included in this advisory. Siemens WinCC 7.0 SP3 web server and web applications are affected.
These vulnerabilities may allow an attacker to gain unauthorized access, read from, or write to files and settings on the target system.
Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.
Much more:
http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf
