Read the docs
TI-2018-03424 Aliases CVE-2018-4847GHSA-99fm-5qxm-cg7x

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions <…

Priority LOW 21CWE-538Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-311.

Summary

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session key for accessing server) in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read unencrypted data from the app's directory. Siemens provides mitigations to resolve the security issue.

Why it matters now

EPSS 0.00261 17th percentileScored 2026-11-07
Fix Fixed SIMATIC WinCC OA Operator iOS App (Siemens AG): V1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC WinCC OA Operator iOS Appbefore V1.4V1.4Patch availableCNA
  • SIMATIC WinCC OA Operator iOS App VendorSiemens Affected before V1.4 Fixed in V1.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_wincc_oa_operator:-:*:*:*:*:iphone_os:*:*not specified by NVDVulnerableSiemens
  • cpe:2.3:a:siemens:simatic_wincc_oa_operator:-:*:*:*:*:iphone_os:*:* Versions not specified by NVD Vulnerable ·Siemens

Remediation

  • Fix · CNA SIMATIC WinCC OA Operator iOS App (Siemens AG) Fixed in V1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-4847
  2. 2026-10-03 Alias added: GHSA-99fm-5qxm-cg7x

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences