CVE-2014-1697

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-02-07 · updated 2026-06-17

Description

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.

Affected products

Siemens AG SIMATIC WinCC OA V3.14 and prior: through 3.12

References

http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01
http://osvdb.org/102810
http://secunia.com/advisories/56651
http://www.securityfocus.com/bid/65351
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/90933
http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01
http://osvdb.org/102810
http://secunia.com/advisories/56651
http://www.securityfocus.com/bid/65351
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/90933

Get alerted when CVE-2014-1697 or the next vulnerability affects your stack