SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products
SIMATIC HMI Products are affected by two vulnerabilities that could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Siemens has released updates for the affected products and recommends to update to the latest versions. Siemens also suggests following the listed mitigations for the Unified Comfort Panels.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-15787US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information… | ||||
| CVE-2020-15786US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (10)
- MitigationSIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Mobile Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Unified Comfort Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- MitigationSIMATIC HMI Unified Comfort Panels
Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security
- BehobenSIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - BehobenSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - BehobenSIMATIC HMI Mobile Panels
Update to V16 Update 3
https://support.industry.siemens.com/cs/ww/en/view/109775861 - BehobenSIMATIC HMI Unified Comfort Panels
Update to V16 Update 5
https://support.industry.siemens.com/cs/ww/en/view/109746530 - BehobenSIMATIC HMI Unified Comfort Panels
Update to V16 Update 5
https://support.industry.siemens.com/cs/ww/en/view/109746530
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan