10

CVE-2014-8551

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Simatic Pcs 7 Version 7.1 Update sp1
Siemens ≫ Simatic Pcs7 Version 7.1 Update sp3
Siemens ≫ Simatic Pcs7 Version 7.1 Update sp4
Siemens ≫ Simatic Pcs7 Version 8.0 Update sp1
Siemens ≫ Simatic Pcs7 Version 8.0 Update sp2
Siemens ≫ Simatic Pcs7 Version 8.1
Siemens ≫ Simatic Tiaportal Version 13.0
Siemens ≫ Simatic Tiaportal Version 13.0 Update 3
Siemens ≫ Simatic Tiaportal Version 13.0 Update 5
Siemens ≫ Simatic Wincc Version 7.0
Siemens ≫ Simatic Wincc Version 7.0 Update sp1
Siemens ≫ Simatic Wincc Version 7.0 Update sp2
Siemens ≫ Simatic Wincc Version 7.0 Update sp3
Siemens ≫ Simatic Wincc Version 7.2 Update 1
Siemens ≫ Simatic Wincc Version 7.2 Update 2
Siemens ≫ Simatic Wincc Version 7.2 Update 3
Siemens ≫ Simatic Wincc Version 7.2 Update 4
Siemens ≫ Simatic Wincc Version 7.2 Update 5
Siemens ≫ Simatic Wincc Version 7.2 Update 6
Siemens ≫ Simatic Wincc Version 7.2 Update 7
Siemens ≫ Simatic Wincc Version 7.2 Update 8
Siemens ≫ Simatic Wincc Version 7.3 Update 1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.27% 0.915
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-134508.pdf
Vendor Advisory