Siemens SIMATIC Step 7 (tia Portal) vulnerabilities

6 CVEs affecting Siemens SIMATIC Step 7 (tia Portal), 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-37172, published 2021-08-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-37172, published 2021-08-10. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured passwords when provisioned using TIA…
CVE-2017-6865, published 2017-05-11. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC Automation Tool (All versions < V3.0), SIMATIC NET PC-Software (All versions < V14 SP1), SIMATIC PCS…
CVE-2018-11454, published 2018-08-07. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 (All versions < V13 SP2…
CVE-2016-7165, published 2016-11-15. Medium severity, CVSS 6.4. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Production Suite (All versions < V7.0 SP1 HFX 2), SIMATIC NET PC-Software (All versions < V14),…
CVE-2018-11453, published 2018-08-07. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 (All versions < V13 SP2…
CVE-2018-13811, published 2018-12-13. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1). Password hashes with insufficient computational effort could allow an attacker to access to a project file…