CVE-2020-15798
highpriority · track · 41OT risk · elevatedEPSS 0.052 · 92 %ileDEEUUSEPSS · scored 2026-10-27
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC HMI Comfort Panels (incl.'SIPLUS variants)cisa_csaf_ot
Update to V16 Update 3a or later version
- FixedSIMATIC HMI KTP Mobile Panelscisa_csaf_ot
Update to V16 Update 3a or later version
- FixedSINAMICS GH150cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - FixedSINAMICS GL150 (with option X30)cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - FixedSINAMICS GM150 (with option X30)cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - FixedSINAMICS SH150cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - FixedSINAMICS SL150cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - FixedSINAMICS SM120cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - FixedSINAMICS SM150cisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - FixedSINAMICS SM150icisa_csaf_ot
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens ' operational guidelines for industrial security, and follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf - MitigationSINAMICS GH150siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS GH150 to V16 Update 4 or later version
- MitigationSINAMICS GL150 (with option X30)siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS GL150 (with option X30) to V16 Update 4 or later version
- MitigationSINAMICS GM150 (with option X30)siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS GM150 (with option X30) to V16 Update 4 or later version
- MitigationSINAMICS SH150siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS SH150 to V16 Update 4 or later version
- MitigationSINAMICS SL150siemens_psirt
As only SIMATIC HMI image versions < V15 SP1 Update 6 are affected, please update the HMI Panel image as included in your installation of SINAMICS SL150 to V15 SP1 Update 6 or later version
- MitigationSINAMICS SM120siemens_psirt
As only HMI image versions < V16 Update 3a are affected, please update the HMI Panel images as included in your installation of SINAMICS SM120 to V16 Update 4 or later version
- MitigationSINAMICS SM150siemens_psirt
As only SIMATIC HMI image versions < V15 SP1 Update 6 are affected, please update the HMI Panel image as included in your installation of SINAMICS SM150 to V15 SP1 Update 6 or later version
- MitigationSINAMICS SM150isiemens_psirt
As only SIMATIC HMI image versions < V15 SP1 Update 6 are affected, please update the HMI Panel image as included in your installation of SINAMICS SM150i to V15 SP1 Update 6 or later version
- MitigationSIMATIC HMI Comfort Panels (incl.'SIPLUS variants)cisa_csaf_ot
Disable telnet on the HMI Panels if enabled. Note: By default telnet is disabled.
- MitigationSIMATIC HMI KTP Mobile Panelscisa_csaf_ot
Disable telnet on the HMI Panels if enabled. Note: By default telnet is disabled.
- No fix availableSINAMICS GH150siemens_psirt
Currently no remediation is available
- No fix availableSINAMICS GL150 (with option X30)siemens_psirt
Currently no remediation is available
- No fix availableSINAMICS GM150 (with option X30)siemens_psirt
Currently no remediation is available
- No fix availableSINAMICS SH150siemens_psirt
Currently no remediation is available
- No fix availableSINAMICS SL150siemens_psirt
Currently no remediation is available
- No fix availableSINAMICS SM120siemens_psirt
Currently no remediation is available
- No fix availableSINAMICS SM150siemens_psirt
Currently no remediation is available
- No fix availableSINAMICS SM150isiemens_psirt
Currently no remediation is available
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (48)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- SSA-752103SSA-752103: Telnet Authentication Vulnerability in SINAMICS Medium Voltage Products2021-05-11csaf · siemens_psirtDE
SINAMICS medium voltage products, with telnet enabled on SIMATIC comfort HMI Panels, are affected by a remote access vulnerability that could allow an attacker, under certain conditions, to gain full remote access to the HMI. Note that by default telnet is disabled, but it can be enabled by the system integrator on request. Siemens has released updates for the affected products, and recommends to update them to the latest version.
- ICSA-21-033-02Siemens SIMATIC HMI Comfort Panels & SIMATIC HMI KTP Mobile Panels2021-01-28icsa · cisa_csaf_otUS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
- ICSA-21-131-13Siemens SINAMICS Medium Voltage Products Telnet (Update A)2021-05-11icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to gain full remote access to the HMI.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-520004.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-752103.pdfcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-033-02cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-131-13cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-HMI-code-execution-via-Unauthenticated-Telnet-34430cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.0384/cnnvd
- https://www.siemens.com/Patchcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-520004.pdfenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan