Is CVE-2010-2772 being actively exploited?

CVE-2010-2772 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2010-2772?

CVE-2010-2772 has a CVSS 3.1 base score of 7.8 (HIGH).

CVE-2010-2772

HIGH · CVSS 7.8EPSS 0.5%EU EUVD

Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stuxnet worm, a different vulnerability than CVE-2010-2568.

Key facts

CVSS score: 7.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-798
EPSS score: 0.5% (46th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2010-2776)
Published: July 22, 2010
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2010-2776 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

siemens / simatic pcs 7
siemens / simatic pcs 7
siemens / simatic pcs 7
siemens / simatic pcs 7
siemens / simatic pcs 7
siemens / simatic pcs 7
siemens / simatic wincc
siemens / simatic wincc

References

http://ics-cert.us-cert.gov/advisories/ICSA-12-205-01(Third Party Advisory, US Government Resource)
http://infoworld.com/d/security-central/new-weaponized-virus-targets-industrial-secrets-725(Press/Media Coverage)
http://infoworld.com/d/security-central/siemens-warns-users-dont-change-passwords-after-worm-attack-915?sourcefssr(Press/Media Coverage)
http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/(Press/Media Coverage)
http://secunia.com/advisories/40682(Broken Link)
http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=43876783&caller=viewhttp://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=43876783&c(Not Applicable)
http://www.automation.siemens.com/forum/guests/PostShow.aspx?PostID=16127&16127&Language=en&PageIndex=1(Broken Link)
http://www.f-secure.com/weblog/archives/00001987.html(Third Party Advisory)
http://www.sea.siemens.com/us/News/Industrial/Pages/WinCC_Update.aspx(Broken Link, Vendor Advisory)
http://www.securityfocus.com/bid/41753(Broken Link, Third Party Advisory, VDB Entry)
http://www.vupen.com/english/advisories/2010/1893(Broken Link)
http://www.wilderssecurity.com/showpost.php?p=1712134&postcount=22(Exploit, Issue Tracking)
http://www.wired.com/threatlevel/2010/07/siemens-scada/(Press/Media Coverage, Third Party Advisory)
https://exchange.xforce.ibmcloud.com/vulnerabilities/60587(Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain