Web server
12.6 Standard Web pages
S7-1200 Programmable controller
1014 System Manual, V4.2, 09/2016, A5E02486680-AK
STEP 7 provides a default user named "Everybody" with no password. By default, this user
has no additional privileges and can only view the Start (Page 1018) and Introduction
(Page 1017) standard Web pages. You can, however, grant additional privileges to the
"Everybody" user as well as other users that you configure:
Granting privileges to the "Everybody" user makes it possible to log in to the Web server
with no password. Unauthorized access to the CPU or changing PLC variables to invalid
values could disrupt process operation and could result in death, severe personal injury
and/or property damage.
Because the "Everybody" user when granted sufficient privileges can perform operating
mode changes, writes to PLC data, and firmware updates with no password, Siemens
recommends that you observe the following security practices
• Enable access to the Web server only with the HTTPS protocol.
• Password-protect Web server user IDs (Page 1005) with a strong password. Strong
passwords are at least ten characters in length, mix letters, numbers, and special
characters, are not words that can be found in a dictionary, and are not names or
identifiers that can be derived from personal information. Keep the password secret and
change it frequently.
• Do not extend the default minimum privileges of the "Everybody" user.
• Perform error-checking and range-checking on your variables in your program logic
because Web page users can change PLC variables to invalid values.
• Use a secure Virtual Private Network (VPN) to connect to the S7-1200 PLC Web server
from a location outside your protected network.
To Next Page
Loading...
