Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2016-7165: A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Producti

30
Routine
MEDIUM 6.4MITIGATEMITIGATEMITIGATE

CVE-2016-7165 is a medium-severity flaw (CVSS 6.4) affecting primary setup tool, security configuration tool, simatic it production suite. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Production Suite (All versions < V7.0 SP1 HFX 2), SIMATIC NET PC-Software (All versions < V14), SIMATIC PCS 7 V7.1 (All versions), SIMATIC PCS 7 V8.0 (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2), SIMATIC STEP 7 V5.X (All versions < V5.5 SP

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score6.4 (Medium)
Attack vectorLocal
Attack complexityHigh
Privileges neededHigh
User interactionNone
EPSS exploit chance0.4% (top 68%)
CISA exploited listNo
WeaknessCWE-254, CWE-284
Published2016-11-15
Last modified2026-06-17
Publisher (CNA): MITRE · Vendor: siemens

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

siemens primary setup tool MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy primary-setup-tool || rpm -q primary-setup-tool || primary-setup-tool --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
siemens security configuration tool MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy security-configuration-tool || rpm -q security-configuration-tool || security-configuration-tool --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
siemens simatic it production suite MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy simatic-it-production-suite || rpm -q simatic-it-production-suite || simatic-it-production-suite --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
siemens simatic net pc software UPGRADE
Affected: <= 14.0
Fixed in: newer than 14.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy simatic-net-pc-software || rpm -q simatic-net-pc-software || simatic-net-pc-software --version
2. UPGRADE to newer than 14.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade simatic-net-pc-software
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade simatic-net-pc-software
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
siemens simatic pcs 7 UPGRADE
Affected: <= 7.1
Fixed in: newer than 7.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy simatic-pcs-7 || rpm -q simatic-pcs-7 || simatic-pcs-7 --version
2. UPGRADE to newer than 7.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade simatic-pcs-7
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade simatic-pcs-7
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
siemens simatic pcs7 DOWNGRADE
Affected: 8.0 · 8.1 · 8.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0
1. Check installed version
apt-cache policy simatic-pcs7 || rpm -q simatic-pcs7 || simatic-pcs7 --version
2. No fixed release: DOWNGRADE to a release before 8.0 (Debian / Ubuntu)
apt-cache madison simatic-pcs7 sudo apt install simatic-pcs7=<VERSION_BEFORE_8.0> sudo apt-mark hold simatic-pcs7
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list simatic-pcs7 sudo dnf downgrade simatic-pcs7-<VERSION_BEFORE_8.0> sudo dnf versionlock add simatic-pcs7
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2016-7165?

primary setup tool: mitigate or apply the listed mitigation; security configuration tool: mitigate or apply the listed mitigation; simatic it production suite: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2016-7165 being exploited?

CVE-2016-7165 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2016-7165 affect?

CVE-2016-7165 affects primary setup tool, security configuration tool, simatic it production suite. Severity is medium (CVSS 6.4). A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Production Suite (All versions < V7.0 SP1 HFX 2), SIMATIC NET PC-Software (All versions < V14), SIMATIC PCS 7 V7.1 (All versions), SIMATIC

How urgent is CVE-2016-7165?

Priority 30/100. No elevated risk signals yet.

Software pages

Siemens vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.