siemens simatic wincc

Name: siemens simatic wincc
Brand: siemens

productUS

cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

by severity

2critical14high13medium1low

updated 2026-10-28

vulnerabilities (33)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2016-5743US	critical9.8	10.5% (96th)	—	no fix	2016-07-22	2 versions
CVE-2014-8551US	high10.0	5.27% (93rd)	—	no fix	2014-11-26	3 versions
CVE-2016-5744US	high7.5	4.40% (91st)	—	no fix	2016-07-22	2 versions
CVE-2017-14023US	medium4.9	3.67% (90th)	—	no fix	2017-11-06	= 7.3
CVE-2019-10922US	critical9.8OT elevated	2.64% (85th)	—	no fix	2019-05-14	2 versions
CVE-2021-40142US	high7.5	2.56% (85th)	—	no fix	2021-08-27	—
CVE-2018-4832US	high7.5	2.42% (84th)	—	7.2	2018-04-24	4 versions
CVE-2014-8552US	medium5.0	2.05% (81st)	—	no fix	2014-11-26	3 versions
CVE-2019-10918US	high8.8	1.93% (80th)	—	no fix	2019-05-14	4 versions
CVE-2017-6867US	medium4.9	1.92% (80th)	—	no fix	2017-05-11	2 versions
CVE-2019-10916US	high8.8	1.54% (75th)	—	no fix	2019-05-14	4 versions
CVE-2016-9160US	high8.1	1.42% (73rd)	—	no fix	2016-12-17	≤ 7.1
CVE-2019-19282US	high7.1	1.34% (71st)	—	no fix	2020-03-10	7 versions
CVE-2019-10935US	high7.2	1.30% (70th)	—	no fix	2019-07-11	7 versions
CVE-2021-40358US	high7.5	1.27% (70th)	—	no fix	2021-11-09	6 versions
CVE-2021-40359US	medium5.0	1.17% (67th)	—	no fix	2021-11-09	5 versions
CVE-2019-10929US	medium5.9OT elevated	0.98% (62nd)	—	16	2019-08-13	< 16
CVE-2021-40360US	high8.8	0.68% (52nd)	—	7.4	2022-02-09	9 versions
CVE-2010-2772US	high7.8OT elevated	0.55% (46th)	—	no fix	2010-07-22	2 versions
CVE-2017-6865US	medium6.5	0.47% (40th)	—	no fix	2017-05-11	—
CVE-2020-7580US	medium6.7	0.46% (40th)	—	7.4	2020-06-10	3 versions
CVE-2016-7165US	medium6.4	0.38% (32nd)	—	no fix	2016-11-15	5 versions
CVE-2020-10048US	medium5.5OT elevated	0.34% (27th)	—	7.5	2021-02-09	2 versions
CVE-2023-28829US	high8.8	0.29% (22nd)	—	8.0	2023-06-13	< 8.0
CVE-2023-48364US	medium6.5	0.27% (19th)	—	no fix	2024-02-13	3 versions
CVE-2023-48363US	medium6.5	0.27% (19th)	—	no fix	2024-02-13	3 versions
CVE-2019-10917US	medium5.5	0.27% (18th)	—	no fix	2019-05-14	4 versions
CVE-2023-46280US	—	0.26% (18th)	—	no fix	2024-05-14	—
CVE-2021-40364US	low2.1	0.24% (15th)	—	no fix	2021-11-09	5 versions
CVE-2022-24287US	medium4.6OT elevated	0.24% (15th)	—	no fix	2022-05-20	2 versions
CVE-2024-49849US	—	0.22% (12th)	—	no fix	2024-12-10	—
CVE-2024-52051US	—	0.18% (7th)	—	no fix	2024-12-10	—
CVE-2021-40363US	high7.8OT elevated	0.16% (5th)	—	7.4	2022-02-09	9 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation10 CVEs
CWE-284Improper Access Control4 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor3 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-254CWE-2542 CVEs
CWE-476NULL Pointer Dereference2 CVEs
CWE-111Direct Use of Unsafe JNI1 CVEs

sources (2)

Which sources assert this record, and when.

USNVD / CVE30 CVEs
NLNCSC-NL (CSAF)3 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan