CVE-2016-9160
Description
A vulnerability in SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under certain conditions.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| siemens | simatic_pcs_7 | {"endIncluding":"8.0"} | |
| siemens | simatic_wincc | {"endIncluding":"7.1"} | |
References
- http://www.securityfocus.com/bid/94825
- http://www.securitytracker.com/id/1037435
- http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-693129.pdf
- https://ics-cert.us-cert.gov/advisories/ICSA-16-348-04
- http://www.securityfocus.com/bid/94825
- http://www.securitytracker.com/id/1037435
- http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-693129.pdf
- https://ics-cert.us-cert.gov/advisories/ICSA-16-348-04
CWEs
CWE-111 CWE-254
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.