CVE-2014-4686

CVE-2014-4686 is a medium-severity vulnerability in Siemens Simatic Pcs7 with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.

Frequently asked questions

What is CVE-2014-4686?
The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.
How severe is CVE-2014-4686?
CVE-2014-4686 has a CVSS 2.0 base score of 6.8, rated medium severity.
Is CVE-2014-4686 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-4686?
CVE-2014-4686 primarily affects Siemens Simatic Pcs7. In total, 16 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-4686?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2014-4686 published?
CVE-2014-4686 was published on 2014-07-24 and last updated on 2026-06-17.

References

Affected products (16)

More vulnerabilities in Siemens Simatic Pcs7

All CVEs affecting Siemens Simatic Pcs7 →