CVE-2017-6867

mediumPriorität · verfolgen · 21EPSS 0.019 · 80. PerzentilEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.92% (80th) EPSS
CVSS 4 · medium
Is it mine?
15 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-27

A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal) Professional (V13 before SP2 and V14 before SP1) that could allow an authenticated, remote attacker who is member of the "administrators" group to crash services by sending specially crafted messages to the DCOM interface.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenSIMATIC WinCCcisa_csaf_ot

    As a general security measure Siemens strongly recommends protecting network access to SIMATIC WinCC, SIMATIC WinCC Runtime, and SIMATIC WinCC (TIA Portal) Professional stations with appropriate mechanisms. Siemens advises configuring the environment according to Siemens operational guidelines in order to run the devices in a protected IT environment.

  • BehobenSIMATIC WinCC Runtime Professional / SIMATIC WinCC (TIA Portal) Professionalcisa_csaf_ot

    As a general security measure Siemens strongly recommends protecting network access to SIMATIC WinCC, SIMATIC WinCC Runtime, and SIMATIC WinCC (TIA Portal) Professional stations with appropriate mechanisms. Siemens advises configuring the environment according to Siemens operational guidelines in order to run the devices in a protected IT environment.

  • BehobenSIMATIC PCS 7 V8.1cisa_csaf_ot

    Update WinCC to V7.3 Upd 13 - Download: https://support.industry.siemens.com/cs/ww/en/view/109746452

    https://support.industry.siemens.com/cs/ww/en/view/109746452
  • MitigationSIMATIC PCS 7 V8.1cisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Apply Defense-in-Depth

  • MitigationSIMATIC PCS 7 V8.2cisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Apply Defense-in-Depth

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

4.9
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04mediumAV:N/AC:L/Au:S/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 2.9
v3.04.9mediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.2 · Auswirkung 3.6
v3.04.9mediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.04.5mediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USprimärCWE-20USCWE-787USCWE-787US
04

betroffene Produkte (15)

Betroffene Produkte und Versionsbereiche.

05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-17-129-03Siemens SIMATIC WinCC and SIMATIC WinCC Runtime Professional2017-05-09icsa · cisa_csaf_otUS

    ATTENTION: Remotely exploitable/low skill level to exploit.

  • ICSA-17-306-01ICSA-17-306-01 Siemens SIMATIC PCS 7 (Update A)2017-10-18icsa · cisa_csaf_otUS

    CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otnvdNVDCVE.orgMITRE
veröffentlicht 2017-05-11geändert 2026-06-17
09

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan