Critical severity · published Feb 9, 2021
CVE-2020-15798
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl
9.8
CVSS
5.2%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Simatic Hmi Comfort Panels Firmware · Siemens
before 16.0; 16.0; 16.0; 16.0; 16.0 · source: NVD
SH
Simatic Hmi Ktp Mobile Panels Firmware · Siemens
before 16.0; 16.0; 16.0; 16.0; 16.0 · source: NVD
SG
Sinamics Gh150 Firmware · Siemens
All versions, or not specified · source: NVD
SG
Sinamics Gl150 Firmware · Siemens
All versions, or not specified · source: NVD
SG
Sinamics Gm150 Firmware · Siemens
All versions, or not specified · source: NVD
SS
Sinamics Sh150 Firmware · Siemens
All versions, or not specified · source: NVD
SS
Sinamics Sl150 Firmware · Siemens
All versions, or not specified · source: NVD
SS
Sinamics Sm120 Firmware · Siemens
All versions, or not specified · source: NVD
SS
Sinamics Sm150 Firmware · Siemens
All versions, or not specified · source: NVD
SS
Sinamics Sm150i Firmware · Siemens
All versions, or not specified · source: NVD
Affected product
SH
Simatic Hmi Comfort Panels Firmware
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15798
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15798
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-520004.pdf
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-752103.pdf
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-033-02
More from Simatic Hmi Comfort Panels Firmware
9.8
CVE-2020-15786
A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl
9.1
CVE-2019-6572
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1…
8.8
CVE-2018-13814
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP…
8.1
CVE-2018-13813
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update…
7.5
CVE-2022-40227
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl
