PT-2017-13207 · Siemens · Wincc+1

Published 2017-11-06 · Updated 2021-11-15 · CVE-2017-14023

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC PCS 7 versions prior to V8.1 SP1 with WinCC V7.3 Upd 13 Siemens SIMATIC PCS 7 version V8.2

Description An Improper Input Validation issue allows an authenticated remote attacker who is a member of the administrators group to crash services by sending specially crafted messages to the DCOM interface.

Recommendations For versions prior to V8.1 SP1 with WinCC V7.3 Upd 13, update to V8.1 SP1 or later to resolve the issue. For version V8.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-14023

Affected Products

Simatic Pcs 7

Wincc

References · 5

• https://osv.dev/vulnerability/CVE-2017-14023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14023 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-306-01 · Note
• http://securitytracker.com/id/1039729 · Note
• http://securityfocus.com/bid/101680 · Note