CVE-2020-15786

9.8CRITICAL

Key Information:

Vendor
Siemens
Status
Simatic Hmi Basic Panels 2nd Generation (incl. Siplus Variants)
Simatic Hmi Comfort Panels (incl. Siplus Variants)
Simatic Hmi Mobile Panels
Simatic Hmi Unified Comfort Panels
Vendor
CVE Published:
9 September 2020

Summary

A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions <= V16), SIMATIC HMI Mobile Panels (All versions <= V16), SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently block excessive authentication attempts. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.

Affected Version(s)

SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) All versions < V16

SIMATIC HMI Comfort Panels (incl. SIPLUS variants) All versions <= V16

SIMATIC HMI Mobile Panels All versions <= V16

References

https://cert-portal.siemens.com/productcert/pdf/ssa-54252...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.