Vulnerability record · CVE-2017-6867 · published 11 May 2017

CVE-2017-6867: Siemens simatic wincc out-of-bounds write vulnerability

Siemens · Simatic Wincc

A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal) Professional (V13 before SP2 and V14 before SP1) that could allow an authenticated, remote attacker who is member of the "administrators" group to crash services by sending specially crafted messages to the DCOM interface.

4.9 CVSS 3.0 Medium EPSS 1.9% · top 20.5% CWE-787 · Out-of-bounds writeCWE-20 · Improper input validation

4.9CVSS 3.0 base score, v2 4.0

1.9%EPSS exploitation probability, 30 days

NoNot in CISA KEV

3Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Simatic Wincc Siemens

Simatic Wincc \(Tia Portal\) Siemens

Simatic Wincc Runtime Siemens

References

Link	Tags
http://www.securityfocus.com/bid/98368	Third Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-523365.pdf
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-156872.pdf	Vendor Advisory
http://www.securityfocus.com/bid/98368	Third Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-523365.pdf
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-156872.pdf	Vendor Advisory

Track CVE-2017-6867 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2014-8551Siemens simatic pcs 7 code injection vulnerabilityThe WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through S…EPSS 5.3%26 Nov 2014 9.9CVE-2021-40358Siemens simatic pcs 7 path traversal vulnerabilityA vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All …EPSS 1.3%9 Nov 2021 9.8CVE-2019-10922Siemens simatic pcs 7 missing authentication for critical function vulnerabilityA vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2…EPSS 2.6%14 May 2019 9.8CVE-2016-5743Siemens simatic batch improper input validation vulnerabilitySiemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1…EPSS 10%22 Jul 2016 9.3CVE-2011-3321Siemens simatic wincc flexible runtime memory buffer overflow vulnerabilityHeap-based buffer overflow in the Siemens WinCC Runtime Advanced Loader, as used in SIMATIC WinCC flexible Runtime and SIMATIC WinCC (TIA Portal) Run…EPSS 7.1%16 Sep 2011 9.1CVE-2019-6572Siemens simatic hmi comfort panels firmware information exposure vulnerabilityA vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 1…EPSS 2.7%14 May 2019 8.8CVE-2023-28829Siemens simatic net pc software vulnerabilityA vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (Al…EPSS 0.29%13 Jun 2023 8.8CVE-2021-40360Siemens simatic pcs 7 information exposure vulnerabilityA vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 …EPSS 0.68%9 Feb 2022

Source: NIST National Vulnerability Database (record CVE-2017-6867), CISA KEV, FIRST EPSS (scores of 2026-10-15). This page is refreshed as NVD updates the record.