Siemens Spcanywhere vulnerabilities

5 CVEs affecting Siemens Spcanywhere, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-1599, published 2015-03-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1597, published 2015-03-07. Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days. The Siemens SPCanywhere application for Android does not use encryption during the loading of code, which allows man-in-the-middle attackers to execute arbitrary code by modifying the client-server…
CVE-2015-1596, published 2015-03-07. Medium severity, CVSS 5.8. EPSS: 0.7% chance of exploitation in the next 30 days. The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive…
CVE-2015-1595, published 2015-03-07. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP…
CVE-2015-1599, published 2015-03-07. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass intended access restrictions by leveraging a filesystem architectural error.
CVE-2015-1598, published 2015-03-07. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Siemens SPCanywhere application for Android does not properly store application passwords, which allows physically proximate attackers to obtain sensitive information by examining the device…