# Siemens AG Primary Setup Tool (PST): A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2… CVE record · `CVE-2017-6865` - **Identifiers:** `CVE-2017-6865` - **State:** Confirmed - **Severity:** No CVSS score - **Critical:** No - **CNA:** siemens - **Technologies:** [Siemens AG Primary Setup Tool (PST)](https://agentprime.io/advisories/technology/siemens-ag-primary-setup-tool-pst.md) · [Siemens AG SIMATIC Automation Tool](https://agentprime.io/advisories/technology/siemens-ag-simatic-automation-tool.md) · [Siemens AG SIMATIC NET PC-Software](https://agentprime.io/advisories/technology/siemens-ag-simatic-net-pc-software.md) · [Siemens AG SIMATIC PCS 7 V8.1](https://agentprime.io/advisories/technology/siemens-ag-simatic-pcs-7-v8-1.md) · [Siemens AG SIMATIC PCS 7 V8.2](https://agentprime.io/advisories/technology/siemens-ag-simatic-pcs-7-v8-2.md) · [Siemens AG SIMATIC STEP 7 (TIA Portal) V13](https://agentprime.io/advisories/technology/siemens-ag-simatic-step-7-tia-portal-v13.md) · [Siemens AG SIMATIC STEP 7 (TIA Portal) V14](https://agentprime.io/advisories/technology/siemens-ag-simatic-step-7-tia-portal-v14.md) · [Siemens AG SIMATIC STEP 7 V5.X](https://agentprime.io/advisories/technology/siemens-ag-simatic-step-7-v5-x.md) · [Siemens AG SIMATIC WinAC RTX 2010 SP2](https://agentprime.io/advisories/technology/siemens-ag-simatic-winac-rtx-2010-sp2.md) · [Siemens AG SIMATIC WinAC RTX F 2010 SP2](https://agentprime.io/advisories/technology/siemens-ag-simatic-winac-rtx-f-2010-sp2.md) · [Siemens AG SIMATIC WinCC (TIA Portal) V13](https://agentprime.io/advisories/technology/siemens-ag-simatic-wincc-tia-portal-v13.md) · [Siemens AG SIMATIC WinCC (TIA Portal) V14](https://agentprime.io/advisories/technology/siemens-ag-simatic-wincc-tia-portal-v14.md) · [Siemens AG SIMATIC WinCC V7.2 and prior](https://agentprime.io/advisories/technology/siemens-ag-simatic-wincc-v7-2-and-prior.md) · [Siemens AG SIMATIC WinCC V7.3](https://agentprime.io/advisories/technology/siemens-ag-simatic-wincc-v7-3.md) · [Siemens AG SIMATIC WinCC V7.4](https://agentprime.io/advisories/technology/siemens-ag-simatic-wincc-v7-4.md) · [Siemens AG SIMATIC WinCC flexible 2008](https://agentprime.io/advisories/technology/siemens-ag-simatic-wincc-flexible-2008.md) · [Siemens AG SINAUT ST7CC](https://agentprime.io/advisories/technology/siemens-ag-sinaut-st7cc.md) · [Siemens AG SINEMA Server](https://agentprime.io/advisories/technology/siemens-ag-sinema-server.md) · [Siemens AG SINUMERIK 808D Programming Tool](https://agentprime.io/advisories/technology/siemens-ag-sinumerik-808d-programming-tool.md) · [Siemens AG SMART PC Access](https://agentprime.io/advisories/technology/siemens-ag-smart-pc-access.md) - **Published:** 11 May 2017 - **Updated:** 5 Aug 2024 - **Reviewed by a person:** No Published by the CVE Program (CNA: siemens) at 11 May 2017, 10:00 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: Siemens AG. Product: Primary Setup Tool (PST). - affected: `All versions < V4.2 HF1` - Vendor: Siemens AG. Product: SIMATIC Automation Tool. - affected: `All versions < V3.0` - Vendor: Siemens AG. Product: SIMATIC NET PC-Software. - affected: `All versions < V14 SP1` - Vendor: Siemens AG. Product: SIMATIC PCS 7 V8.1. - affected: `All versions` - Vendor: Siemens AG. Product: SIMATIC PCS 7 V8.2. - affected: `All versions < V8.2 SP1` - Vendor: Siemens AG. Product: SIMATIC STEP 7 (TIA Portal) V13. - affected: `All versions < V13 SP2` - Vendor: Siemens AG. Product: SIMATIC STEP 7 (TIA Portal) V14. - affected: `All versions < V14 SP1` - Vendor: Siemens AG. Product: SIMATIC STEP 7 V5.X. - affected: `All versions < V5.6` - Vendor: Siemens AG. Product: SIMATIC WinAC RTX 2010 SP2. - affected: `All versions` - Vendor: Siemens AG. Product: SIMATIC WinAC RTX F 2010 SP2. - affected: `All versions` - Vendor: Siemens AG. Product: SIMATIC WinCC (TIA Portal) V13. - affected: `All versions < V13 SP2` - Vendor: Siemens AG. Product: SIMATIC WinCC (TIA Portal) V14. - affected: `All versions < V14 SP1` - Vendor: Siemens AG. Product: SIMATIC WinCC V7.2 and prior. - affected: `All versions` - Vendor: Siemens AG. Product: SIMATIC WinCC V7.3. - affected: `All versions < V7.3 Update 15` - Vendor: Siemens AG. Product: SIMATIC WinCC V7.4. - affected: `All versions < V7.4 SP1 Upd1` - Vendor: Siemens AG. Product: SIMATIC WinCC flexible 2008. - affected: `All versions < flexible 2008 SP5` - Vendor: Siemens AG. Product: SINAUT ST7CC. - affected: `All versions installed in conjunction with SIMATIC WinCC < V7.3 Update 15` - Vendor: Siemens AG. Product: SINEMA Server. - affected: `All versions < V14` - Vendor: Siemens AG. Product: SINUMERIK 808D Programming Tool. - affected: `All versions < V4.7 SP4 HF2` - Vendor: Siemens AG. Product: SMART PC Access. - affected: `All versions < V2.3` - Vendor: Siemens AG. Product: STEP 7 - Micro/WIN SMART. - affected: `All versions < V2.3` - Vendor: Siemens AG. Product: Security Configuration Tool (SCT). - affected: `All versions < V5.0` - Vendor: Siemens AG. Product: Security Configuration Tool (SCT). - affected: `All versions < V5.0` ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation No source has published a CVSS score for this record yet. - **CISA KEV:** Not listed. - **EPSS:** 0.0047, the 40th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 11 May 2017. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2017-6865](https://www.cve.org/CVERecord?id=CVE-2017-6865) - [NVD: CVE-2017-6865](https://nvd.nist.gov/vuln/detail/CVE-2017-6865) ### References from the CNA - (confirm) - (vdb-entry, bid) Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .