Siemens SIMATIC Wincc Runtime vulnerabilities

13 CVEs affecting Siemens SIMATIC Wincc Runtime, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-30694, published 2022-11-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-3321, published 2011-09-16. High severity, CVSS 9.3. EPSS: 7.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Siemens WinCC Runtime Advanced Loader, as used in SIMATIC WinCC flexible Runtime and SIMATIC WinCC (TIA Portal) Runtime Advanced, allows remote attackers to cause a…
CVE-2018-13812, published 2018-12-13. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4), SIMATIC HMI KTP…
CVE-2019-6572, published 2019-05-14. Critical severity, CVSS 9.1. EPSS: 2.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI…
CVE-2021-40142, published 2021-08-27. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages that lead to Access of a Memory Location…
CVE-2017-6867, published 2017-05-11. Medium severity, CVSS 4.9. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal)…
CVE-2019-6576, published 2019-05-14. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI…
CVE-2018-13814, published 2018-12-13. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels…
CVE-2018-13813, published 2018-12-13. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4), SIMATIC HMI KTP…
CVE-2019-10935, published 2019-07-11. High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with…
CVE-2019-10929, published 2019-08-13. Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU…

Latest

CVE-2022-30694, published 2022-11-08. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login…
CVE-2019-6577, published 2019-05-14. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI…