6.8

CVE-2014-4686

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.

Data is provided by the National Vulnerability Database (NVD)
Siemens ≫ Simatic Pcs7 Updatesp1 Version <= 8.0
Siemens ≫ Simatic Pcs7 Version7.1 Updatesp3
Siemens ≫ Simatic Pcs7 Version8.0
Siemens ≫ Wincc Version <= 7.2
Siemens ≫ Wincc Version5.0
Siemens ≫ Wincc Version5.0 Updatesp1
Siemens ≫ Wincc Version6.0
Siemens ≫ Wincc Version6.0 Updatesp2
Siemens ≫ Wincc Version6.0 Updatesp3
Siemens ≫ Wincc Version6.0 Updatesp4
Siemens ≫ Wincc Version7.0
Siemens ≫ Wincc Version7.0 Updatesp1
Siemens ≫ Wincc Version7.0 Updatesp2
Siemens ≫ Wincc Version7.0 Updatesp3
Siemens ≫ Wincc Version7.1
Siemens ≫ Wincc Version7.1 Updatesp1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.23% 0.459
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P