Brute Force Authentication Vulnerability in Siemens HMI Panels
CVE-2020-15786

9.8CRITICAL

Key Information:

Vendor
Siemens
Status
Simatic Hmi Basic Panels 2nd Generation (incl. Siplus Variants)
Simatic Hmi Comfort Panels (incl. Siplus Variants)
Simatic Hmi Mobile Panels
Simatic Hmi Unified Comfort Panels
Vendor
CVE Published:
9 September 2020

Summary

A vulnerability exists in various models of Siemens SIMATIC HMI Panels, wherein these devices fail to adequately restrict excessive authentication attempts. This weakness permits a remote attacker to perform brute-force attacks, potentially allowing them to guess user passwords and gain unauthorized access to the Sm@rt Server. Implementing strong password policies and enhancing account lockout mechanisms are critical measures to mitigate this risk.

Affected Version(s)

SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) All versions < V16

SIMATIC HMI Comfort Panels (incl. SIPLUS variants) All versions <= V16

SIMATIC HMI Mobile Panels All versions <= V16

References

https://cert-portal.siemens.com/productcert/pdf/ssa-54252...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.