Vulnerability Description
The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Simatic Pcs7 | <= 8.0 |
| Siemens | Wincc | <= 7.2 |
References
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_adviVendor Advisory
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_adviVendor Advisory
FAQ
What is CVE-2014-4686?
CVE-2014-4686 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive inform...
How severe is CVE-2014-4686?
CVE-2014-4686 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-4686?
Check the references section above for vendor advisories and patch information. Affected products include: Siemens Simatic Pcs7, Siemens Wincc.