CVE-2020-15782

highpriority · track · 41EPSS 0.052 · 92 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
5.18% (92nd) EPSS
CVSS 7.5 · high
Is it mine?
66 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-26

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINAMICS PERFECT HARMONY GH180 Drives (Drives manufactured before 2021-08-13), SINUMERIK MC (All versions < V6.15), SINUMERIK ONE (All versions < V6.15). Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to port 102/tcp could potentially write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedfesto_psirt

    Update Siemens Simatic S7-1500 / ET200SP Firmware to V2.9.2 or higher

    https://support.industry.siemens.com/cs/de/en/view/109478459
  • FixedSIMATIC Drive Controller familysiemens_psirt

    Update to V2.9.2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109773914/
  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Update to V21.9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Update to V4.5.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Update to V2.9.2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 Software Controllersiemens_psirt

    Update to V21.9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478528/
  • FixedSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Update to V4.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109795016/
  • FixedSINAMICS PERFECT HARMONY GH180 Drivessiemens_psirt

    Drives manufactured on 2021-08-13 or later are not affected, as they contain a corrected version of the S7-1500 or S7-1200 CPU.

  • FixedSINUMERIK MCsiemens_psirt

    Update to V6.15 or later version

  • FixedSINUMERIK ONEsiemens_psirt

    Update to V6.15 or later version

  • FixedSIMATIC Drive Controller familycisa_csaf_ot

    Update to V2.9.2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109773914/
  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot

    Update to V21.9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot

    Update to V4.5.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot

    Update to V2.9.2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 Software Controllercisa_csaf_ot

    Update to V21.9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478528/
  • FixedSIMATIC S7-PLCSIM Advancedcisa_csaf_ot

    Update to V4.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109795016/
  • FixedSINAMICS PERFECT HARMONY GH180 Drivescisa_csaf_ot

    Siemens has identified the following specific mitigations and workarounds users can apply to reduce the risk:

  • FixedSINAMICS PERFECT HARMONY model 6SR4cisa_csaf_ot

    Siemens has identified the following specific mitigations and workarounds users can apply to reduce the risk:

  • FixedSINAMICS PERFECT HARMONY model 6SR5cisa_csaf_ot

    Siemens has identified the following specific mitigations and workarounds users can apply to reduce the risk:

  • FixedSINUMERIK MCcisa_csaf_ot

    Update to V6.15 or later version

  • FixedSINUMERIK ONEcisa_csaf_ot

    Update to V6.15 or later version

  • FixedSiemens Simatic S7-1500 / ET200SP < V2.9.2 installed on FESTO Didactic CP including S7 PLCcisa_csaf_ot

    Update Siemens Simatic S7-1500 / ET200SP Firmware to V2.9.2 or higher

    https://support.industry.siemens.com/cs/de/en/view/109478459
  • FixedSiemens Simatic S7-1500 / ET200SP < V2.9.2 installed on FESTO Didactic MPS 200 Systemscisa_csaf_ot

    Update Siemens Simatic S7-1500 / ET200SP Firmware to V2.9.2 or higher

    https://support.industry.siemens.com/cs/de/en/view/109478459
  • FixedSiemens Simatic S7-1500 / ET200SP < V2.9.2 installed on FESTO Didactic MPS 400 Systemscisa_csaf_ot

    Update Siemens Simatic S7-1500 / ET200SP Firmware to V2.9.2 or higher

    https://support.industry.siemens.com/cs/de/en/view/109478459
  • MitigationSIMATIC Drive Controller familysiemens_psirt

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)siemens_psirt

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC S7-1500 Software Controllersiemens_psirt

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSINAMICS PERFECT HARMONY GH180 Drivessiemens_psirt

    Avoid compromise of the individually configured access protection password to the S7-1500 or S7-1200 CPU

  • MitigationSINUMERIK MCsiemens_psirt

    Limit access to port 102/tcp to trusted users and systems only

  • MitigationSINUMERIK ONEsiemens_psirt

    Limit access to port 102/tcp to trusted users and systems only

  • MitigationSIMATIC Drive Controller familycisa_csaf_ot

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)cisa_csaf_ot

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC S7-1500 Software Controllercisa_csaf_ot

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSIMATIC S7-PLCSIM Advancedcisa_csaf_ot

    Apply "defense in depth" as outlined on pages 12ff of the operational guidelines for Industrial Security, especially: - Plant security: Physical prevention of access to critical components - Network security: Ensure that PLC systems are not connected to untrusted networks * System integrity: Configure, maintain and protect your device by applying applicable compensating controls and using built-in security capabilities

  • MitigationSINUMERIK MCcisa_csaf_ot

    Limit access to port 102/tcp to trusted users and systems only

  • MitigationSINUMERIK ONEcisa_csaf_ot

    Limit access to port 102/tcp to trusted users and systems only

  • No fix availableSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)siemens_psirt

    Currently no remediation is available

  • No fix availableSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)cisa_csaf_ot

    Currently no remediation is available

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.08.1highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Festo PSIRT DE
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-119USCWE-119USCWE-119USCWE-119USCWE-119US
05

affected products (66)

Products and version ranges known to be affected.

showing 20 of 66
06

advisories (8)

Vendor and ecosystem advisories describing this.

  • FSA-202405Festo: Siemens S7-1500/ET200SP CPU used in Festo Didactic products contains a memory protection bypass vulnerability2024-09-09csaf · festo_psirtDE

    Siemens SIMATIC S7-1200 and S7-1500 CPUs contained in various Festo Didactic products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks

  • SSA-434534SSA-434534: Memory Protection Bypass Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families2021-05-28csaf · siemens_psirtDE

    SIMATIC S7-1200 and S7-1500 CPU products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks. Siemens has released updates for several affected products and strongly recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • SSA-434535SSA-434535: Memory Protection Bypass Vulnerability in SINAMICS PERFECT HARMONY GH180 Drives2021-07-13csaf · siemens_psirtDE

    Several models of SINAMICS PERFECT HARMONY GH180 Drives are affected by a memory protection bypass vulnerability in the integrated S7-1500 or S7-1200 CPU that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks on the CPU. Siemens provides new drives with the fix included and recommends specific countermeasures for older drives. The list of affected drive models can be found in the section "Additional Information".

  • SSA-434536SSA-434536: Memory Protection Bypass Vulnerability in SINUMERIK ONE and SINUMERIK MC2021-07-13csaf · siemens_psirtDE

    SINUMERIK ONE and SINUMERIK MC products are affected by a memory protection bypass vulnerability in the integrated S7-1500 CPU that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks on the CPU. Siemens has released updates for the affected products and recommends that customers update to the new version.

  • ICSA-21-152-01Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update A)2021-05-28icsa · cisa_csaf_otUS

    SIMATIC S7-1200 and S7-1500 CPU products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks. Siemens has released updates for several affected products and strongly recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • ICSA-21-194-13Siemens SINAMICS PERFECT HARMONY GH180 (Update A)2021-07-13icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could result in arbitrary code execution and unauthorized access to sensitive data.

  • ICSA-21-194-17Siemens SINUMERIK ONE and SINUMERIK MC (Update A)2021-07-13icsa · cisa_csaf_otUS

    SINUMERIK ONE and SINUMERIK MC products are affected by a memory protection bypass vulnerability in the integrated S7-1500 CPU that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks on the CPU. Siemens has released updates for the affected products and recommends that customers update to the new version.

  • ICSA-25-182-01FESTO Didactic CP, MPS 200, and MPS 400 Firmware2024-09-09icsa · cisa_csaf_otUS

    Siemens SIMATIC S7-1200 and S7-1500 CPUs contained in various Festo Didactic products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otfesto_psirtsiemens_psirtNVDCVE.orgMITRE
published 2021-05-28modified 2026-06-17
09

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan