CVEvulnerability

CVE-2017-6871

5.4 MEDIUM Published 2017-08-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-08-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.4 MEDIUM — CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287, CWE-288

Description

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (All versions before V1.0.2.2). An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass the app's authentication mechanism under certain conditions.

Affected configurations

• siemens simatic wincc sm\@rtclient (<= 1.0.2.1) • siemens simatic wincc sm\@rtclient lite (<= 1.0.2.1)

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References