vulnwire
5.4med

CVE-2017-6871

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClien…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
5.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 25%
Public exploits
0
none known

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (All versions before V1.0.2.2). An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass the app's authentication mechanism under certain conditions.

Exploit prediction (EPSS)

0.32% probability of exploitation in the next 30 days, higher than 25% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.4CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • n/a SIMATIC WinCC Sm@rtClient for Android, SIMATIC WinCC Sm@rtClient Lite for Android

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel
  • CWE-287 Improper Authentication

References

  • securityfocus.com /bid/99582 · vdb-entry, x_refsource_BID, x_transferred
  • siemens.com /cert/pool/cert/siemens_security_advisory_ssa-589378.pdf · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.