Skip to content
OpenAdvisories
Medium SSA-914168 2 CVEs

SSA-914168: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products

Published Feb 8, 2022 · Updated Aug 9, 2022 · Revision 4

Vendor: Siemens Product: SIMATIC PCS 7 V8.2 Product: SIMATIC PCS 7 V9.0 Product: SIMATIC PCS 7 V9.1 Product: SIMATIC WinCC V15 and earlier Product: SIMATIC WinCC V16 Product: SIMATIC WinCC V17 Product: SIMATIC WinCC V7.4 Product: SIMATIC WinCC V7.5

Summary

Multiple vulnerabilities were found in SIMATIC WinCC that ultimately
could allow attackers to retrieve and brute force password hashes and
access other systems.

Siemens has released updates for several affected products and
recommends to update to the latest versions. Siemens is preparing
further updates and recommends specific countermeasures for products
where updates are not, or not yet available.

Vulnerabilities 2

Revision history

  1. #4

    Added solution to SIMATIC WinCC V17 (for CVE-2021-40363)

  2. #3

    Added solution for SIMATIC WinCC V15

  3. #2

    Added solution for SIMATIC WinCC V7.4, SIMATIC PCS 7 V8.2 and SIMATIC PCS 7 V9.0

  4. #1

    Publication Date

References