Auth bypass in Siemens Simatic Hmi Comfort Panels
CVE-2020-15798
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.052 (92.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.052 · newest: 0.052 · change: 0.000
Affected products
- Siemens Simatic Hmi Comfort Panels
- Siemens Simatic Hmi Comfort Panels Firmware — versions 16.0
- Siemens Simatic Hmi Comfort Panels (Incl. Siplus Variants) — versions All versions < V16 Update 3a
- Siemens Simatic Hmi Ktp Mobile Panels — versions All versions < V16 Update 3a
- Siemens Simatic Hmi Ktp Mobile Panels
- Siemens Simatic Hmi Ktp Mobile Panels Firmware — versions 16.0
- Siemens Sinamics Gh150 — versions All versions
- Siemens Sinamics Gh150
- Siemens Sinamics Gh150 Firmware
- Siemens Sinamics Gl150
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert-portal.siemens.com/productcert/pdf/ssa-520004.pdf (Vendor Advisory)
- us-cert.cisa.gov/ics/advisories/icsa-21-033-02 (US Government Resource, Third Party Advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-752103.pdf (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-15798?
- CVE-2020-15798 is a critical-severity vulnerability in Siemens Simatic Hmi Comfort Panels, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2021-02-09.
- How severe is CVE-2020-15798?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2020-15798 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.