Unscored severity · published Feb 18, 2015
CVE-2015-1358
The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4)…
–
CVSS
2.7%
EPSS
No
On KEV
Description
The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wincc · Siemens
13.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1358
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1358
www.securityfocus.com
http://www.securityfocus.com/bid/72625
www.securitytracker.com
http://www.securitytracker.com/id/1036090
www.siemens.com
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf
Vendor Advisory
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf
US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02
More from Wincc
8.2
CVE-2017-12069
An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367
7.8
CVE-2023-30897
A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13)
–
CVE-2015-2823
Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC WinCC Runtime…
–
CVE-2015-2822
Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2 allow man-in-the-middle attackers…
–
CVE-2014-4686
The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to…