Siemens Wincc Open Architecture vulnerabilities

2 CVEs affecting Siemens Wincc Open Architecture, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-33139, published 2022-06-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0160: OpenSSL Information Disclosure Vulnerability, published 2014-04-07. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-05-04. EPSS: 100% chance of exploitation in the next 30 days. The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process…
CVE-2022-33139, published 2022-06-21. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC…