SAP Plant Connectivity vulnerabilities

3 CVEs affecting SAP Plant Connectivity, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-2827, published 2023-06-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-8330, published 2015-11-24. High severity, CVSS 7.8. EPSS: 3% chance of exploitation in the next 30 days. The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619.
CVE-2017-16690, published 2017-12-12. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It is possible that SAPSetup / NwSapSetup.exe loads system DLLs…
CVE-2023-2827, published 2023-06-13. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent…