CVE-2017-6869

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload arbitrary code and execute it with the permissions of the operating-system user running the web server by sending specially crafted network packets to port 443/TCP or port 80/TCP.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	ViewPort for Web Office Portal before revision number 1453	ViewPort for Web Office Portal before revision number 1453

References

http://www.securityfocus.com/bid/99343Third Party Advisory, VDB Entry
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-545214.pdfVendor Advisory
http://www.securityfocus.com/bid/99343Third Party Advisory, VDB Entry
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-545214.pdfVendor Advisory

Timeline

Published: Aug 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-68707.4A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2). The existing TLS protocol im CVE-2017-68715.4A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient CVE-2017-68726.5A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker with access to port 2 CVE-2017-68737.4A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulat CVE-2017-68747.0Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and sys CVE-2017-68776.1Cross-site scripting (XSS) vulnerability in SVG file handling in Lutim 0.7.1 and earlier allows remote attackers to inject arbitrary web scr CVE-2017-68785.4Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the CVE-2017-68809.8Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspeci CVE-2017-68834.7The ConvertToPDF plugin in Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 on Windows, when the gflags app is enabled, allows remote a CVE-2017-68848.8A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is locate CVE-2017-68859.8An error when handling certain external commands and services related to the FlexNet Inventory Agent and FlexNet Beacon of the Flexera Softw CVE-2017-68869.8An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt mem