SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products
SIMATIC HMI Products are affected by two vulnerabilities that could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Siemens has released updates for the affected products and recommends to update to the latest versions. Siemens also suggests following the listed mitigations for the Unified Comfort Panels.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-15787US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information… | ||||
| CVE-2020-15786US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All… | ||||
references
External citations — patches, advisories, analysis.
remediations (10)
- MitigationSIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Mobile Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Unified Comfort Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Unified Comfort Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- FixedSIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - FixedSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - FixedSIMATIC HMI Mobile Panels
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - FixedSIMATIC HMI Unified Comfort Panels
Update to V16 Update 5
https://support.industry.siemens.com/cs/ww/en/view/109746530 - FixedSIMATIC HMI Unified Comfort Panels
Update to V16 Update 5
https://support.industry.siemens.com/cs/ww/en/view/109746530
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan