CVE-2017-6871 json
A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClien…
published 2017-08-08 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-15925
- cvss
- 5.4
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (All versions before V1.0.2.2). An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass the app's authentication mechanism under certain conditions.
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-17-194-03 updated cvss 4.6
Siemens SIMATIC Sm@rtClient Android App
-
Siemens SIMATIC WinCC Sm@rtClient for Android < 1.0.2.2 Siemens SIMATIC WinCC Sm@rtClient Lite for Android < 1.0.2.2affected: vendor fix play.google.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.4 | CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a SIMATIC WinCC Sm@rtClient for Android, SIMATIC WinCC Sm@rtClient Lite for Android
Classification
References
-
siemens.com
/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf
vendor-advisory
-
securityfocus.com
/bid/99582
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-6871
- NVD CVE-2017-6871
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.