{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SIMATIC S7-1200 CPU V2 devices contain an insufficiently protected private key used for the Certificate Authority (CA) for HTTPS connections. Possession of this key could allow remote attackers to spoof the device\u0027s web server by creating a forged web server certificate.\n\nSiemens recommends specific countermeasures for products where fixes are not, or not yet available.\nRefer to the chapter Additional Information for more details.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V2 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-240718.html"
      },
      {
        "category": "self",
        "summary": "SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V2 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-240718.json"
      }
    ],
    "title": "SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V2",
    "tracking": {
      "current_release_date": "2025-10-14T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-240718",
      "initial_release_date": "2012-09-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2012-09-13T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2020-02-10T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "SIPLUS devices now explicitly mentioned in the list of affected products"
        },
        {
          "date": "2025-10-14T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Used CVE ID (CVE-2012-3037) instead of the deprecated SVE ID (SVE-2012-0003); Corrected CVSS vector of CVE-2012-3037; Updated SSA to current data model and support of csaf"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-3037",
      "cwe": {
        "id": "CWE-321",
        "name": "Use of Hard-coded Cryptographic Key"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly protect the private key of the integrated Certification Authority (CA) certificate. Possession of this key could allow remote attackers to spoof the device\u0027s web server by creating a forged web server certificate.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Uninstall the affected CA keys from the browser\u0027s certificate store.",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2012-3037"
    }
  ]
}