CVE-2020-15798
highPriorität · verfolgen · 41OT-Risiko · erhöhtEPSS 0.052 · 92. PerzentilDEEUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSIMATIC HMI Comfort Panels (incl.'SIPLUS variants)cisa_csaf_ot
Update to V16 Update 3a or later version
- BehobenSIMATIC HMI KTP Mobile Panelscisa_csaf_ot
Update to V16 Update 3a or later version
- BehobenSINAMICS GH150cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - BehobenSINAMICS GL150 (with option X30)cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - BehobenSINAMICS GM150 (with option X30)cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - BehobenSINAMICS SH150cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - BehobenSINAMICS SL150cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - BehobenSINAMICS SM120cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - BehobenSINAMICS SM150cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - BehobenSINAMICS SM150icisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - MitigationSINAMICS GH150siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS GH150 to V16 Update 4 or later version
- MitigationSINAMICS GL150 (with option X30)siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS GL150 (with option X30) to V16 Update 4 or later version
- MitigationSINAMICS GM150 (with option X30)siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS GM150 (with option X30) to V16 Update 4 or later version
- MitigationSINAMICS SH150siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS SH150 to V16 Update 4 or later version
- MitigationSINAMICS SL150siemens_psirt
As only SIMATIC HMI image versions < V15 SP1 Update 6 are affected, please update the HMI Panel image as included in your installation of SINAMICS SL150 to V15 SP1 Update 6 or later version
- MitigationSINAMICS SM120siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS SM120 to V16 Update 4 or later version
- MitigationSINAMICS SM150siemens_psirt
As only SIMATIC HMI image versions < V15 SP1 Update 6 are affected, please update the HMI Panel image as included in your installation of SINAMICS SM150 to V15 SP1 Update 6 or later version
- MitigationSINAMICS SM150isiemens_psirt
As only SIMATIC HMI image versions < V15 SP1 Update 6 are affected, please update the HMI Panel image as included in your installation of SINAMICS SM150i to V15 SP1 Update 6 or later version
- MitigationSIMATIC HMI Comfort Panels (incl.'SIPLUS variants)cisa_csaf_ot
Disable telnet on the HMI Panels if enabled. Note: By default telnet is disabled.
- MitigationSIMATIC HMI KTP Mobile Panelscisa_csaf_ot
Disable telnet on the HMI Panels if enabled. Note: By default telnet is disabled.
- Kein Fix verfügbarSINAMICS GH150siemens_psirt
Currently no remediation is available
- Kein Fix verfügbarSINAMICS GL150 (with option X30)siemens_psirt
Currently no remediation is available
- Kein Fix verfügbarSINAMICS GM150 (with option X30)siemens_psirt
Currently no remediation is available
- Kein Fix verfügbarSINAMICS SH150siemens_psirt
Currently no remediation is available
- Kein Fix verfügbarSINAMICS SL150siemens_psirt
Currently no remediation is available
- Kein Fix verfügbarSINAMICS SM120siemens_psirt
Currently no remediation is available
- Kein Fix verfügbarSINAMICS SM150siemens_psirt
Currently no remediation is available
- Kein Fix verfügbarSINAMICS SM150isiemens_psirt
Currently no remediation is available
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.1–9.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (48)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-752103SSA-752103: Telnet Authentication Vulnerability in SINAMICS Medium Voltage Products2021-05-11csaf · siemens_psirtDE
SINAMICS medium voltage products, with telnet enabled on SIMATIC comfort HMI Panels, are affected by a remote access vulnerability that could allow an attacker, under certain conditions, to gain full remote access to the HMI. Note that by default telnet is disabled, but it can be enabled by the system integrator on request. Siemens has released updates for the affected products, and recommends to update them to the latest version.
- ICSA-21-033-02Siemens SIMATIC HMI Comfort Panels & SIMATIC HMI KTP Mobile Panels2021-01-28icsa · cisa_csaf_otUS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
- ICSA-21-131-13Siemens SINAMICS Medium Voltage Products Telnet (Update A)2021-05-11icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to gain full remote access to the HMI.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (13)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-520004.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-752103.pdfcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-033-02cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-131-13cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-HMI-code-execution-via-Unauthenticated-Telnet-34430cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.0384/cnnvd
- https://www.siemens.com/Patchcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-520004.pdfenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan