Siemens SIMATIC WinCC Runtime Advanced

Name: Siemens SIMATIC WinCC Runtime Advanced
Brand: Siemens

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

10critical9high6medium0low

updated 2026-10-25

vulnerabilities (31)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-3449US	medium5.9	63.5% (99th)	Exploit	no fix	2021-03-25	≤ All versions < V17 Update 1
CVE-2019-8287US	critical9.8	19.5% (97th)	—	no fix	2019-10-29	2 versions
CVE-2019-15678US	critical9.8	12.8% (96th)	—	no fix	2019-10-29	2 versions
CVE-2019-15679US	critical9.8	11.8% (96th)	—	no fix	2019-10-29	2 versions
CVE-2019-8262US	critical9.8	4.84% (92nd)	—	V16_Update_4	2019-03-05	2 versions
CVE-2019-8280US	critical9.8	4.25% (91st)	—	V16_Update_4	2019-03-08	2 versions
CVE-2019-8275US	critical9.8	3.97% (90th)	—	V16_Update_4	2019-03-08	2 versions
CVE-2018-13812US	high7.5	3.57% (89th)	—	V15_Update_4	2018-12-13	< V15_Update_4
CVE-2019-8265US	critical9.8	3.14% (88th)	—	V16_Update_4	2019-03-08	2 versions
CVE-2019-8264US	critical9.8	3.13% (88th)	—	V16_Update_4	2019-03-08	2 versions
CVE-2019-8259US	high7.5	3.01% (87th)	—	V16_Update_4	2019-03-05	2 versions
CVE-2011-4508US	high9.3	2.98% (87th)	—	no fix	2012-02-03	≤ 11\|11\|SP1\|11\|SP2
CVE-2019-8277US	high7.5	2.97% (87th)	—	V16_Update_4	2019-03-08	2 versions
CVE-2019-15680US	high7.5	2.67% (86th)	—	no fix	2019-10-29	2 versions
CVE-2019-8263US	medium6.5	2.48% (84th)	—	V16_Update_4	2019-03-05	2 versions
CVE-2019-8260US	critical9.8	2.25% (83rd)	—	V16_Update_4	2019-03-05	2 versions
CVE-2019-8261US	critical9.8	2.24% (83rd)	—	V16_Update_4	2019-03-05	2 versions
CVE-2011-4509US	high10.0OT elevated	1.98% (80th)	—	no fix	2012-02-03	≤ 11\|11\|SP1\|11\|SP2
CVE-2018-13814US	high8.8	1.68% (77th)	—	V14	2018-12-13	< V14
CVE-2018-13813US	high8.1	1.68% (77th)	—	V15_Update_4	2018-12-13	< V15_Update_4
CVE-2019-6575US	high7.5	1.65% (76th)	—	V15.1 Upd 4	2019-04-17	4 versions
CVE-2019-6568US	medium5.0	1.40% (72nd)	—	V15.1_Upd4	2019-04-17	3 versions
CVE-2019-10929US	medium5.9OT elevated	0.98% (62nd)	—	V16	2019-08-13	3 versions
CVE-2020-7580US	medium6.7	0.46% (39th)	—	V16_Update_2	2020-06-10	3 versions
CVE-2023-30756US	—	0.45% (38th)	—	no fix	2024-09-10	3 versions
CVE-2023-28827US	—	0.45% (38th)	—	no fix	2024-09-10	3 versions
CVE-2023-30755US	—	0.43% (37th)	—	no fix	2024-09-10	3 versions
CVE-2020-7592US	medium6.5OT elevated	0.33% (25th)	—	no fix	2020-07-14	≤ vers:all/*
CVE-2022-30694US	—	0.32% (24th)	—	vers:/_V17_Update_5	2022-11-08	3 versions
CVE-2023-46280US	—	0.26% (17th)	—	V17 Update 8	2024-05-14	3 versions
CVE-2025-30033US	—	0.21% (10th)	—	V17 Update 9	2025-08-12	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-125Out-of-bounds Read7 CVEs
CWE-787Out-of-bounds Write7 CVEs
CWE-476NULL Pointer Dereference5 CVEs
CWE-122Heap-based Buffer Overflow3 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-788Access of Memory Location After End of Buffer3 CVEs
CWE-665Improper Initialization2 CVEs
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')1 CVEs

sources (3)

Which sources assert this record, and when.

USCISA CSAF OT advisories (ICS)30 CVEs
DESiemens ProductCERT (CSAF)25 CVEs
EUEU Vulnerability Database (ENISA)10 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan