Siemens SIMATIC Wincc Oa vulnerabilities

4 CVEs affecting Siemens SIMATIC Wincc Oa, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-44731, published 2022-12-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-20093, published 2021-06-16. Critical severity, CVSS 9.1. EPSS: 33.3% chance of exploitation in the next 30 days. A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter…
CVE-2019-6575, published 2019-04-17. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V2.7), SIMATIC HMI Comfort…
CVE-2022-44731, published 2022-12-13. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024),…
CVE-2021-41057, published 2021-11-14. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.