CVE-2020-0591

mediumpriority · track · 27EPSS 0.003 · 24 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.31% (24th) EPSS

CVSS 4.6 · medium

Is it mine?

17 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Improper buffer restrictions in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (MLFB: 6ES7518-4AX00-1AC0, 6AG1518-4AX00-4AC0, incl. SIPLUS variant)siemens_psirt
Avoid to run untrusted code on affected systems
MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPsiemens_psirt
Avoid to run untrusted code on affected systems
MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (MLFB: 6ES7518-4AX00-1AC0, 6AG1518-4AX00-4AC0, incl. SIPLUS variant)cisa_csaf_ot
Avoid to run untrusted code on affected systems
MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPcisa_csaf_ot
Avoid to run untrusted code on affected systems
No fix plannedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (MLFB: 6ES7518-4AX00-1AC0, 6AG1518-4AX00-4AC0, incl. SIPLUS variant)siemens_psirt
Currently no remediation is planned
No fix plannedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPsiemens_psirt
Currently no remediation is planned
No fix plannedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (MLFB: 6ES7518-4AX00-1AC0, 6AG1518-4AX00-4AC0, incl. SIPLUS variant)cisa_csaf_ot
Currently no remediation is planned
No fix plannedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPcisa_csaf_ot
Currently no remediation is planned

cvss

Technical severity, 0–10. One row per scoring source.

6.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 6.4

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 0.8 · impact 5.9

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · CISA US

v3.16.7mediumAV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-119USCWE-119USCWE-120US

affected products (17)

Products and version ranges known to be affected.

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (MLFB: 6ES7518-4AX00-1AC0, 6AG1518-4AX00-4AC0, incl. SIPLUS variant)all versionscisa_csaf_otUS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)all versionscisa_csaf_otUS
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (MLFB: 6ES7518-4AX00-1AC0, 6AG1518-4AX00-4AC0, incl. SIPLUS variant)≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP≤ vers:all/*cisa_csaf_otUS
n/a Intel(R) Processors≤ See referencesenisa_euvdEU
Intel Corp. 2nd Generation Intel Xeon Scalable Processorall versionsfstec_bduRU
Intel Corp. Intel Core X-seriesall versionsfstec_bduRU
Intel Corp. Intel Xeon Processor D Familyall versionsfstec_bduRU
Intel Corp. Intel Xeon Scalableall versionsfstec_bduRU
Intel Corp. Intel Xeon W Processorall versionsfstec_bduRU
Intel Corp. Intel Xeon W Processor Familyall versionsfstec_bduRU
intel biosall versionsnvdUScpe:2.3:o:intel:bios:*:*:*:*:*:*:*:*
siemens simatic cpu 1518-4 firmwareall versionsnvdUScpe:2.3:o:siemens:simatic_cpu_1518-4_firmware:*:*:*:*:*:*:*:*
siemens simatic cpu 1518f-4 firmwareall versionsnvdUScpe:2.3:o:siemens:simatic_cpu_1518f-4_firmware:*:*:*:*:*:*:*:*
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (MLFB: 6ES7518-4AX00-1AC0, 6AG1518-4AX00-4AC0, incl. SIPLUS variant)≤ vers:all/*siemens_psirtDE
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP≤ vers:all/*siemens_psirtDE
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)≤ vers:all/*siemens_psirtDE

advisories (2)

Vendor and ecosystem advisories describing this.

SSA-501073SSA-501073: Vulnerabilities in Controllers CPU 1518 MFP using Intel CPUs (November 2020)2021-05-11csaf · siemens_psirtDE
Intel has published information on vulnerabilities in Intel products in November 2020. This advisory lists the Siemens Controllers that are affected by these vulnerabilities. In this advisory we take a representative CVE from each advisory: - “Intel CSME, SPS, TXE, AMT and DAL Advisory” Intel-SA-00391 is represented by CVE-2020-8744 - “BIOS Advisory” Intel-SA-00358 is represented by CVE-2020-0591. Siemens is currently working on BIOS updates that include chipset microcode updates and recommends specific countermeasures for products where updates are not, or not yet available.
ICSA-21-131-15Siemens SIMATIC S7-15002021-05-11icsa · cisa_csaf_otUS
Intel has published information on vulnerabilities in Intel products in November 2020. This advisory lists the Siemens Controllers that are affected by these vulnerabilities. In this advisory we take a representative CVE from each advisory: - “Intel CSME, SPS, TXE, AMT and DAL Advisory” Intel-SA-00391 is represented by CVE-2020-8744 - “BIOS Advisory” Intel-SA-00358 is represented by CVE-2020-0591. Siemens is currently working on BIOS updates that include chipset microcode updates and recommends specific countermeasures for products where updates are not, or not yet available.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

published 2020-11-12modified 2026-06-17

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan