Siemens SIMATIC Wincc vulnerabilities

34 CVEs affecting Siemens SIMATIC Wincc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-32736, published 2024-11-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-5743, published 2016-07-22. Critical severity, CVSS 9.8. EPSS: 10.5% chance of exploitation in the next 30 days. Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.1 Update 3 as…
CVE-2014-8551, published 2014-11-26. High severity, CVSS 10.0. EPSS: 5.3% chance of exploitation in the next 30 days. The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6…
CVE-2016-5744, published 2016-07-22. High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days. Siemens SIMATIC WinCC 7.0 through SP3 and 7.2 allows remote attackers to read arbitrary WinCC station files via crafted packets.
CVE-2017-14023, published 2017-11-06. Medium severity, CVSS 4.9. EPSS: 3.7% chance of exploitation in the next 30 days. An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versions. The improper input validation vulnerability has been…
CVE-2019-10922, published 2019-05-14. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3…
CVE-2021-40142, published 2021-08-27. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages that lead to Access of a Memory Location…
CVE-2018-4832, published 2018-04-24. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability has been identified in OpenPCS 7 V7.1 and earlier (All versions), OpenPCS 7 V8.0 (All versions), OpenPCS 7 V8.1 (All versions < V8.1 Upd5), OpenPCS 7 V8.2 (All versions), OpenPCS 7…
CVE-2014-8552, published 2014-11-26. Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days. The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6…
CVE-2019-10918, published 2019-05-14. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with…
CVE-2017-6867, published 2017-05-11. Medium severity, CVSS 4.9. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal)…

Latest

CVE-2023-32736, published 2024-11-12. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions <…
CVE-2024-35783, published 2024-09-10. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All versions < V2022…
CVE-2024-30321, published 2024-07-09. Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19…
CVE-2023-32735, published 2024-07-09. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATIC STEP 7 Safety V18 (All versions < V18…
CVE-2023-48364, published 2024-02-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC…
CVE-2023-48363, published 2024-02-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC…
CVE-2023-28829, published 2023-06-13. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions),…
CVE-2022-24287, published 2022-05-20. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime…
CVE-2021-40363, published 2022-02-09. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions…
CVE-2021-40360, published 2022-02-09. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions…