Out-of-bounds write in Siemens SIMATIC WinCC
Priority LOW 26CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal) Professional (V13 before SP2 and V14 before SP1) that could allow an authenticated, remote attacker who is member of the "administrators" group to crash services by sending specially crafted messages to the DCOM interface.
Why it matters now
EPSS 0.01923 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Siemens SIMATIC WinCC | Siemens SIMATIC WinCC | — | No fix listed | CNA |
- Siemens SIMATIC WinCC Vendor— Affected Siemens SIMATIC WinCC Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):13:sp1:*:*:professional:*:*:* | 13 sp1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):14:*:*:*:professional:*:*:* | 14 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:13:sp1:*:*:professional:*:*:* | 13 sp1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:14:*:*:*:professional:*:*:* | 14 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):13:sp1:*:*:professional:*:*:* Versions 13 sp1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):14:*:*:*:professional:*:*:* Versions 14 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:13:sp1:*:*:professional:*:*:* Versions 13 sp1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:14:*:*:*:professional:*:*:* Versions 14 Vulnerable ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6867
- 2026-10-03 Alias added: GHSA-f7g5-6g5q-8c2q
References
More Siemens Simatic Wincc vulnerabilities
- TI-2016-04985 Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before… CVSS 3.0CRITICAL 9.8
- TI-2014-07026 The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3… CVSS 2.0HIGH 10.0
- TI-2019-08143 Missing authentication in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1CRITICAL 9.8
- TI-2021-17429 Path traversal in Siemens SIMATIC PCS 7 V8.2 CVSS 3.1CRITICAL 9.9
- TI-2019-08139 A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions)… CVSS 3.1HIGH 8.8
- TI-2019-08137 SQL injection in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1HIGH 8.8
Sources
- CVE-2017-6867 · CVE Program
- CVE-2017-6867 · NVD
- FIRST EPSS
- GHSA-f7g5-6g5q-8c2q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences