Siemens AG SIMATIC WinCC

Name: Siemens AG SIMATIC WinCC
Brand: Siemens AG

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

2critical13high14medium0low

updated 2026-10-27

vulnerabilities (37)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-44228US	critical10.0OT critical	100.0% (100th)	KEV	no fix	2021-12-10	≤ 7.4 SP1
CVE-2019-10922US	critical9.8OT elevated	2.64% (85th)	—	no fix	2019-05-14	2 versions
CVE-2021-40142US	high7.5	2.56% (85th)	—	no fix	2021-08-27	—
CVE-2018-4832US	high7.5	2.42% (84th)	—	no fix	2018-04-24	3 versions
CVE-2015-2823US	medium6.8	2.13% (82nd)	—	no fix	2015-04-08	2 versions
CVE-2013-3958US	high7.5OT elevated	1.93% (80th)	—	no fix	2013-06-14	≤ 7.2.0.1
CVE-2019-10918US	high8.8	1.93% (80th)	—	no fix	2019-05-14	3 versions
CVE-2013-3957US	high7.5	1.78% (78th)	—	no fix	2013-06-14	≤ 7.2.0.1
CVE-2014-4682US	medium5.0	1.69% (77th)	—	no fix	2014-07-24	5.0 → 7.2
CVE-2019-10916US	high8.8	1.54% (75th)	—	no fix	2019-05-14	4 versions
CVE-2019-19282US	high7.1	1.34% (71st)	—	no fix	2020-03-10	3 versions
CVE-2014-4684US	medium6.0	1.34% (71st)	—	no fix	2014-07-24	5.0 → 7.2
CVE-2013-3959US	medium4.0	1.33% (71st)	—	no fix	2013-06-14	≤ 7.2.0.1
CVE-2019-10935US	high7.2	1.30% (70th)	—	no fix	2019-07-11	4 versions
CVE-2014-4683US	medium4.9	1.22% (69th)	—	no fix	2014-07-24	5.0 → 7.2
CVE-2014-4686US	medium6.8OT elevated	1.09% (65th)	—	no fix	2014-07-24	5.0 → 7.2
CVE-2021-40360US	high8.8	0.68% (52nd)	—	no fix	2022-02-09	6 versions
CVE-2024-35783US	—	0.61% (49th)	—	no fix	2024-09-10	3 versions
CVE-2024-30321US	—	0.51% (44th)	—	no fix	2024-07-09	3 versions
CVE-2017-6865US	medium6.5	0.47% (40th)	—	no fix	2017-05-11	3 versions
CVE-2020-7580US	medium6.7	0.46% (40th)	—	no fix	2020-06-10	2 versions
CVE-2016-7165US	medium6.4	0.38% (32nd)	—	no fix	2016-11-15	5 versions
CVE-2014-4685US	medium4.6	0.36% (30th)	—	no fix	2014-07-24	5.0 → 7.2
CVE-2023-28829US	high8.8	0.29% (22nd)	—	no fix	2023-06-13	≤ 8.0
CVE-2023-48364US	medium6.5	0.27% (19th)	—	no fix	2024-02-13	3 versions
CVE-2023-48363US	medium6.5	0.27% (19th)	—	no fix	2024-02-13	3 versions
CVE-2019-10917US	medium5.5	0.27% (18th)	—	no fix	2019-05-14	4 versions
CVE-2023-46280US	—	0.26% (18th)	—	no fix	2024-05-14	3 versions
CVE-2022-24287US	medium4.6OT elevated	0.24% (15th)	—	no fix	2022-05-20	2 versions
CVE-2023-32735US	—	0.21% (11th)	—	no fix	2024-07-09	3 versions
CVE-2023-30897US	high7.8	0.21% (11th)	—	no fix	2023-06-13	≤ 7.5.2.13
CVE-2025-30033US	—	0.21% (11th)	—	no fix	2025-08-12	3 versions
CVE-2025-40759US	—	0.18% (8th)	—	no fix	2025-08-12	4 versions
CVE-2023-50821US	—	0.18% (8th)	—	no fix	2024-04-09	2 versions
CVE-2022-44725US	high7.8	0.18% (8th)	—	no fix	2022-11-17	≤ 8.0
CVE-2024-54678US	—	0.17% (6th)	—	no fix	2025-08-12	2 versions
CVE-2021-40363US	high7.8OT elevated	0.16% (5th)	—	no fix	2022-02-09	6 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation7 CVEs
CWE-502Deserialization of Untrusted Data4 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor3 CVEs
CWE-264CWE-2643 CVEs
CWE-284Improper Access Control3 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')2 CVEs
CWE-269Improper Privilege Management2 CVEs
CWE-425Direct Request ('Forced Browsing')2 CVEs

sources (1)

Which sources assert this record, and when.

RUBDU (FSTEC Data Security Threats Database)37 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan