Siemens Wincc Tia Portal vulnerabilities

7 CVEs affecting Siemens Wincc Tia Portal, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-0672, published 2013-03-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-0671, published 2013-03-21. Medium severity, CVSS 4.0. EPSS: 2.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL.
CVE-2013-0669, published 2013-03-21. Medium severity, CVSS 4.0. EPSS: 1.8% chance of exploitation in the next 30 days. The HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted HTTP request.
CVE-2013-0670, published 2013-03-21. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a…
CVE-2013-0668, published 2013-03-21. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the HMI web application in Siemens WinCC (TIA Portal) 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2013-0667, published 2013-03-21. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2013-0672, published 2013-03-21. Low severity, CVSS 3.5. EPSS: 1.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data.
CVE-2011-4515, published 2013-03-21. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. Siemens WinCC (TIA Portal) 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive…