A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4).

Published 8 y ago 2018-04-23 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.6

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.3%

percentile 18%

Public exploits

none known

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session key for accessing server) in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read unencrypted data from the app's directory. Siemens provides mitigations to resolve the security issue.

Exploit prediction (EPSS)

0.26% probability of exploitation in the next 30 days, higher than 18% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	4.6	`CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`

Affected products

Siemens AG SIMATIC WinCC OA Operator iOS App

Classification

Weakness

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-311 Missing Encryption of Sensitive Data

References

securityfocus.com /bid/103941 · vdb-entry, x_refsource_BID, x_transferred
cert-portal.siemens.com /productcert/pdf/ssa-597741.pdf · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-4847
NVD: CVE-2018-4847

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary