CVE-2016-9160: siemens simatic_pcs_7 Direct Use of Unsafe JNI
Vulnerability summary
CVE-2016-9160 is a high (CVSS 8.1) Direct Use of Unsafe JNI vulnerability in siemens simatic_pcs_7. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.4% of scored vulnerabilities.
Timeline
- 17-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability in SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under certain conditions.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.42%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.42% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-111Direct Use of Unsafe JNIWhen a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.
- CWE-2547PK - Security FeaturesSoftware security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Affected systems
Siemens2 products
- simatic_pcs_7≤ 8.0
- simatic_wincc≤ 7.1
1 vendor · 2 products
References
4 links- www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-693129.pdfX Refsource CONFIRM
- ics-cert.us-cert.gov/advisories/ICSA-16-348-04X Refsource MISC