Siemens SIMATIC HMI Products (Update A)
SIMATIC HMI Products are affected by two vulnerabilities that could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Siemens has released updates for the affected products and recommends to update to the latest versions. Siemens also suggests following the listed mitigations for the Unified Comfort Panels.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-15787US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information… | ||||
| CVE-2020-15786US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All… | ||||
references
External citations — patches, advisories, analysis.
- SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products - CSAF Versionself
- SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products - PDF Versionself
- SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products - TXT Versionself
- ICS Advisory ICSA-20-252-06 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-20-252-06 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (10)
- MitigationSIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Mobile Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Unified Comfort Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Unified Comfort Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- FixedSIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - FixedSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - FixedSIMATIC HMI Mobile Panels
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - FixedSIMATIC HMI Unified Comfort Panels
Update to V16 Update 5
https://support.industry.siemens.com/cs/ww/en/view/109746530 - FixedSIMATIC HMI Unified Comfort Panels
Update to V16 Update 5
https://support.industry.siemens.com/cs/ww/en/view/109746530
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan