Auth bypass in Siemens Simatic Hmi Comfort Panels

CVE-2020-15798

A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)

Vulnerability class: Broken Authentication

EPSS: 0.052 (91.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2020-15798?
CVE-2020-15798 is a critical-severity vulnerability in Siemens Simatic Hmi Comfort Panels, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2021-02-09.
How severe is CVE-2020-15798?
Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-15798 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.