CVE-2014-4686
Last modified
CVE-2014-4686 is a vulnerability of currently unknown severity. The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.. EPSS estimates a 1.09% chance of exploitation in the next 30 days.
Description
The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Siemens | Simatic Pcs7 | <= 8.0 | Sp1 |
| Siemens | Simatic Pcs7 | 7.1 | Sp3 |
| Siemens | Simatic Pcs7 | 8.0 | — |
| Siemens | Wincc | <= 7.2 | — |
| Siemens | Wincc | 5.0 | — |
| Siemens | Wincc | 6.0 | — |
| Siemens | Wincc | 7.0 | — |
| Siemens | Wincc | 7.1 | — |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-4686?
How severe is CVE-2014-4686?
How do I fix CVE-2014-4686?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-4677The installPackage function in the installerHelper subcompon…
- CVE-2014-4678The safe_eval function in Ansible before 1.6.4 does not prop…9.8
- CVE-2014-4682The WebNavigator server in Siemens SIMATIC WinCC before 7.3,…
- CVE-2014-4683The WebNavigator server in Siemens SIMATIC WinCC before 7.3,…
- CVE-2014-4684The database server in Siemens SIMATIC WinCC before 7.3, as …
- CVE-2014-4685Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other …
- CVE-2014-4687Multiple cross-site scripting (XSS) vulnerabilities in pfSen…
- CVE-2014-4688pfSense before 2.1.4 allows remote authenticated users to ex…
- CVE-2014-4689Absolute path traversal vulnerability in pkg_edit.php in pfS…
- CVE-2014-4690Multiple directory traversal vulnerabilities in pfSense befo…
- CVE-2014-4691Session fixation vulnerability in pfSense before 2.1.4 allow…
- CVE-2014-4692pfSense before 2.1.4, when HTTP is used, does not include th…
Are you affected by CVE-2014-4686?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST