CVE-2017-14023

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versions. The improper input validation vulnerability has been identified, which may allow an authenticated remote attacker who is a member of the administrators group to crash services by sending specially crafted messages to the DCOM interface.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Siemens SIMATIC PCS 7	Siemens SIMATIC PCS 7

References

http://www.securityfocus.com/bid/101680Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039729Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-306-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/101680Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039729Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-306-01Third Party Advisory, US Government Resource

Timeline

Published: Nov 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-140249.8A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions, and InTouc CVE-2017-140255.5An Improper Input Validation issue was discovered in ABB FOX515T release 1.0. An improper input validation vulnerability has been identified CVE-2017-140267.5In Ice Qube Thermal Management Center versions prior to version 4.13, the web application does not properly authenticate users which may all CVE-2017-140279.8A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX CVE-2017-140287.5A Resource Exhaustion issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Versio CVE-2017-140297.8An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted CVE-2017-140307.8An issue was discovered in Moxa MXview v2.8 and prior. The unquoted service path escalation vulnerability could allow an authorized user wit CVE-2017-140317.8An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user has privileges to re CVE-2017-140328.1ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentica CVE-2017-140337.5The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a CVE-2017-140348.8The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.7 and other products, miscalculates a memcpy destinati CVE-2017-140359.8CrushFTP 8.x before 8.2.0 has a serialization vulnerability.