Siemens SIMATIC HMI Products (Update A)
SIMATIC HMI Products are affected by two vulnerabilities that could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Siemens has released updates for the affected products and recommends to update to the latest versions. Siemens also suggests following the listed mitigations for the Unified Comfort Panels.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-15787US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information… | ||||
| CVE-2020-15786US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products - CSAF Versionself
- SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products - PDF Versionself
- SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products - TXT Versionself
- ICS Advisory ICSA-20-252-06 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-20-252-06 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (10)
- MitigationSIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Mobile Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Unified Comfort Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Unified Comfort Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- BehobenSIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - BehobenSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - BehobenSIMATIC HMI Mobile Panels
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - BehobenSIMATIC HMI Unified Comfort Panels
Update to V16 Update 5
https://support.industry.siemens.com/cs/ww/en/view/109746530 - BehobenSIMATIC HMI Unified Comfort Panels
Update to V16 Update 5
https://support.industry.siemens.com/cs/ww/en/view/109746530
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan