Siemens SIMATIC WinCC Runtime Professional

Name: Siemens SIMATIC WinCC Runtime Professional
Brand: Siemens

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

by severity

5critical7high1medium0low

updated 2026-10-27

vulnerabilities (14)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-8287US	critical9.8	19.5% (97th)	—	no fix	2019-10-29	2 versions
CVE-2019-15678US	critical9.8	12.8% (96th)	—	no fix	2019-10-29	2 versions
CVE-2019-15679US	critical9.8	11.8% (96th)	—	no fix	2019-10-29	2 versions
CVE-2016-5743US	critical9.8	10.5% (96th)	—	V13_SP_1_Update_9	2016-07-22	< V13_SP_1_Update_9
CVE-2016-5744US	high7.5	4.40% (91st)	—	V13_SP_1_Update_9	2016-07-22	< V13_SP_1_Update_9
CVE-2018-13812US	high7.5	3.57% (89th)	—	V15_Update_4	2018-12-13	< V15_Update_4
CVE-2019-15680US	high7.5	2.67% (86th)	—	no fix	2019-10-29	2 versions
CVE-2021-40142US	high7.5	2.56% (85th)	—	V18	2021-08-27	2 versions
CVE-2017-2684US	critical9.0	1.99% (80th)	—	V14_SP1	2017-02-22	< V14_SP1
CVE-2018-13814US	high8.8	1.68% (77th)	—	V14	2018-12-13	< V14
CVE-2018-13813US	high8.1	1.68% (77th)	—	V15_Update_4	2018-12-13	< V15_Update_4
CVE-2019-10929US	medium5.9OT elevated	0.98% (62nd)	—	V16	2019-08-13	3 versions
CVE-2025-30033US	—	0.21% (11th)	—	V21	2025-08-12	3 versions
CVE-2022-44725US	high7.8	0.18% (8th)	—	V18_Update_2	2022-11-17	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation4 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')2 CVEs
CWE-122Heap-based Buffer Overflow2 CVEs
CWE-787Out-of-bounds Write2 CVEs
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')1 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.