Siemens SIMATIC Information Server vulnerabilities

3 CVEs affecting Siemens SIMATIC Information Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-33698, published 2024-09-10.

More from Siemens.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-20093, published 2021-06-16. Critical severity, CVSS 9.1. EPSS: 33.3% chance of exploitation in the next 30 days. A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter…
• CVE-2024-33698, published 2024-09-10. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1…
• CVE-2021-41057, published 2021-11-14. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.