Auth bypass in Siemens Simatic Hmi Comfort Panels
CVE-2020-15798
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)
Vulnerability class: Broken Authentication
EPSS: 0.052 (91.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Siemens Simatic_hmi_comfort_panels
- Siemens Simatic_hmi_comfort_panels_firmware — versions 16.0
- Siemens Simatic Hmi Comfort Panels (Incl. Siplus Variants) — versions All versions < V16 Update 3a
- Siemens Simatic Hmi Ktp Mobile Panels — versions All versions < V16 Update 3a
- Siemens Simatic_hmi_ktp_mobile_panels
- Siemens Simatic_hmi_ktp_mobile_panels_firmware — versions 16.0
- Siemens Sinamics Gh150 — versions All versions
- Siemens Sinamics_gh150
- Siemens Sinamics_gh150_firmware
- Siemens Sinamics_gl150
Weakness classification (CWE)
Public proof-of-concept exploits
References
- productcert@siemens.com (x_refsource_MISC, Vendor Advisory)
- productcert@siemens.com (US Government Resource, Third Party Advisory, x_refsource_MISC)
- productcert@siemens.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-15798?
- CVE-2020-15798 is a critical-severity vulnerability in Siemens Simatic Hmi Comfort Panels, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2021-02-09.
- How severe is CVE-2020-15798?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2020-15798 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.