6.8

CVE-2014-4686

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Simatic Pcs7 Update sp1 Version <= 8.0
Siemens ≫ Simatic Pcs7 Version 7.1 Update sp3
Siemens ≫ Simatic Pcs7 Version 8.0
Siemens ≫ Wincc Version <= 7.2
Siemens ≫ Wincc Version 5.0
Siemens ≫ Wincc Version 5.0 Update sp1
Siemens ≫ Wincc Version 6.0
Siemens ≫ Wincc Version 6.0 Update sp2
Siemens ≫ Wincc Version 6.0 Update sp3
Siemens ≫ Wincc Version 6.0 Update sp4
Siemens ≫ Wincc Version 7.0
Siemens ≫ Wincc Version 7.0 Update sp1
Siemens ≫ Wincc Version 7.0 Update sp2
Siemens ≫ Wincc Version 7.0 Update sp3
Siemens ≫ Wincc Version 7.1
Siemens ≫ Wincc Version 7.1 Update sp1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.09% 0.609
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf
Vendor Advisory