Medium severity · published May 11, 2017
CVE-2017-6867
A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC…
4.9
CVSS
1.9%
EPSS
No
On KEV
Description
A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal) Professional (V13 before SP2 and V14 before SP1) that could allow an authenticated, remote attacker who is member of the "administrators" group to crash services by sending specially crafted messages to the DCOM interface.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Simatic Wincc · Siemens
7.3; 7.4 · source: NVD
SW
Simatic Wincc (tia Portal) · Siemens
13; 14 · source: NVD
SW
Simatic Wincc Runtime · Siemens
13; 14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6867
Third Party Advisory
http://www.securityfocus.com/bid/98368
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/pdf/ssa-523365.pdf
Vendor Advisory
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-156872.pdf
More from Simatic Wincc
9.9
CVE-2021-40358
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC…
9.8
CVE-2019-10922
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2 and earlier (All versions),…
9.8
CVE-2016-5743
Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before…
9.1
CVE-2024-35783
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All…
8.8
CVE-2023-28829
A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7…