By default, Siemens Synco OZW installs with a default password for an unspecified administrator level account. This allows attackers to trivially access the program or system and gain privileged access.

The program enforces an immediate password change in version 4. Prior to that users should, immediately after installation, change all default installed accounts to use a unique and secure password. When possible, change default account names to custom names as well.

• CVE ID: 2012-3020 (see also: NVD)
• Vendor Specific Solution URL: http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=41929231&subtype=130000&caller=view
• Vendor Specific Advisory URL: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-283911.pdf
• Other Advisory URL: http://www.us-cert.gov/control_systems/pdf/ICSA-12-214-01.pdf

• Dan Tentler