Siemens SIMATIC s7 CPU 1200 Firmware vulnerabilities

8 CVEs affecting Siemens SIMATIC s7 CPU 1200 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-2846, published 2016-03-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-2908, published 2014-04-25. Medium severity, CVSS 4.3. EPSS: 20.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified…
CVE-2014-2258, published 2014-03-24. High severity, CVSS 7.8. EPSS: 4.7% chance of exploitation in the next 30 days. Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets, a different vulnerability than…
CVE-2014-2254, published 2014-03-24. High severity, CVSS 7.8. EPSS: 4.7% chance of exploitation in the next 30 days. Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTP packets, a different vulnerability than…
CVE-2014-2256, published 2014-03-24. High severity, CVSS 7.8. EPSS: 3.7% chance of exploitation in the next 30 days. Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted ISO-TSAP packets, a different vulnerability…
CVE-2014-2250, published 2014-03-24. High severity, CVSS 8.3. EPSS: 3.1% chance of exploitation in the next 30 days. The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic…
CVE-2014-2909, published 2014-04-25. Medium severity, CVSS 5.8. EPSS: 2.4% chance of exploitation in the next 30 days. CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors.
CVE-2016-2846, published 2016-03-16. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Siemens SIMATIC S7-1200 CPU devices before 4.0 allow remote attackers to bypass a "user program block" protection mechanism via unspecified vectors.
CVE-2014-2252, published 2014-03-24. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted PROFINET packets, a different vulnerability…