Siemens SIMATIC WinCC V7.4

Name: Siemens SIMATIC WinCC V7.4
Brand: Siemens

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

critical

by severity

0critical10high7medium1low

updated 2026-10-27

vulnerabilities (22)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-0778US	high7.5	73.2% (99th)	Exploit	V7.4_SP1_Update_22	2022-03-15	< V7.4_SP1_Update_22
CVE-2024-38355US	—	0.81% (57th)	Exploit	no fix	2024-06-19	2 versions
CVE-2018-4832US	high7.5	2.42% (84th)	—	V7.4_SP1_Upd_4	2018-04-24	3 versions
CVE-2019-10918US	high8.8	1.93% (80th)	—	V7.4_SP1_Upd_11	2019-05-14	< V7.4_SP1_Upd_11
CVE-2019-10916US	high8.8	1.54% (75th)	—	V7.4_SP1_Upd_11	2019-05-14	< V7.4_SP1_Upd_11
CVE-2019-19282US	high7.1	1.34% (71st)	—	V7.4_SP1_Update_14	2020-03-10	3 versions
CVE-2019-10935US	high7.2	1.30% (70th)	—	V7.4_SP1_Upd_11	2019-07-11	< V7.4_SP1_Upd_11
CVE-2021-40358US	high7.5	1.27% (70th)	—	V7.4_SP1_Update_19	2021-11-09	3 versions
CVE-2021-40359US	medium5.0	1.17% (67th)	—	V7.4_SP1_Update_19	2021-11-09	3 versions
CVE-2023-28831US	high7.5	1.13% (66th)	—	*	2023-09-12	3 versions
CVE-2021-40360US	high8.8	0.68% (52nd)	—	V7.4_SP1_Update_19	2022-02-09	3 versions
CVE-2024-35783US	—	0.61% (49th)	—	*	2024-09-10	3 versions
CVE-2024-30321US	—	0.51% (44th)	—	V7.4_SP1_Update_23	2024-07-09	3 versions
CVE-2017-6865US	medium6.5	0.47% (40th)	—	V7.4_SP1_Upd1	2017-05-11	< V7.4_SP1_Upd1
CVE-2020-7580US	medium6.7	0.46% (40th)	—	V7.4_SP1_Update_14	2020-06-10	3 versions
CVE-2023-48364US	medium6.5	0.27% (19th)	—	*	2024-02-13	3 versions
CVE-2023-48363US	medium6.5	0.27% (19th)	—	*	2024-02-13	3 versions
CVE-2019-10917US	medium5.5	0.27% (18th)	—	V7.4_SP1_Upd_11	2019-05-14	< V7.4_SP1_Upd_11
CVE-2023-46280US	—	0.26% (18th)	—	*	2024-05-14	3 versions
CVE-2021-40364US	low2.1	0.24% (15th)	—	V7.4_SP1_Update_19	2021-11-09	3 versions
CVE-2022-24287US	medium4.6OT elevated	0.24% (15th)	—	V7.4_SP1_Update_21	2022-05-20	3 versions
CVE-2021-40363US	high7.8OT elevated	0.16% (5th)	—	V7.4_SP1_Update_19	2022-02-09	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation6 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-476NULL Pointer Dereference2 CVEs
CWE-1188Initialization of a Resource with an Insecure Default1 CVEs
CWE-125Out-of-bounds Read1 CVEs
CWE-131Incorrect Calculation of Buffer Size1 CVEs
CWE-1357Reliance on Insufficiently Trustworthy Component1 CVEs
CWE-190Integer Overflow or Wraparound1 CVEs

sources (3)

Which sources assert this record, and when.

USCISA CSAF OT advisories (ICS)22 CVEs
DESiemens ProductCERT (CSAF)16 CVEs
EUEU Vulnerability Database (ENISA)15 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan