Siemens SIMATIC Wincc Open Architecture vulnerabilities

8 CVEs affecting Siemens SIMATIC Wincc Open Architecture, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-7580, published 2020-06-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-3991, published 2019-02-05. Critical severity, CVSS 9.8. EPSS: 34.3% chance of exploitation in the next 30 days. An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500. A specially crafted TCP packet can cause a heap overflow,…
CVE-2014-1697, published 2014-02-07. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.
CVE-2014-1698, published 2014-02-07. Medium severity, CVSS 5.0. EPSS: 3.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999.
CVE-2018-13799, published 2018-09-12. Critical severity, CVSS 9.1. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021). Improper access control to a data point of the affected product could allow an unauthenticated…
CVE-2014-1699, published 2014-02-07. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999.
CVE-2014-1696, published 2014-02-07. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVE-2019-10929, published 2019-08-13. Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU…
CVE-2020-7580, published 2020-06-10. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions),…