Unscored severity · published Feb 7, 2014
CVE-2014-1697
The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999
–
CVSS
5.3%
EPSS
No
On KEV
Description
The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Simatic Wincc Open Architecture · Siemens
through 3.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1697
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1697
US Government Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01
osvdb.org
http://osvdb.org/102810
secunia.com
http://secunia.com/advisories/56651
www.securityfocus.com
http://www.securityfocus.com/bid/65351
Vendor Advisory
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/90933
More from Simatic Wincc Open Architecture
9.8
CVE-2018-3991
An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500
9.1
CVE-2018-13799
A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021)
6.7
CVE-2020-7580
A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15…
5.9
CVE-2019-10929
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl
–
CVE-2014-1699
Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999