CVE-2022-38465

highpriority · track · 31EPSS 0.002 · 15 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.24% (15th) EPSS
CVSS 7.8 · high
Is it mine?
81 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSIMATIC Drive Controller familysiemens_psirt

    Update to V2.9.2 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109773914/
  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Update to V21.9 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Update to V4.5.0 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Update to V2.9.2 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 Software Controllersiemens_psirt

    Update to V21.9 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109478528/
  • FixedSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Update to V4.0 or later version, migrate project in TIA Portal to the corresponding version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109795016/
  • FixedSINUMERIK MCsiemens_psirt

    Update to V6.21 or later version SINUMERIK software can be obtained from your local Siemens account manager.

  • FixedSINUMERIK ONEsiemens_psirt

    Update to V6.21 or later version SINUMERIK software can be obtained from your local Siemens account manager.

  • FixedSIMATIC Drive Controller familycisa_csaf_ot

    Update to V2.9.2 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109773914/
  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot

    Update to V21.9 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot

    Update to V4.5.0 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot

    Update to V2.9.2 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 Software Controllercisa_csaf_ot

    Update to V21.9 or later version, migrate project in TIA Portal to this version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109478528/
  • FixedSIMATIC S7-PLCSIM Advancedcisa_csaf_ot

    Update to V4.0 or later version, migrate project in TIA Portal to the corresponding version and redeploy.

    https://support.industry.siemens.com/cs/ww/en/view/109795016/
  • FixedSINUMERIK MCcisa_csaf_ot

    Update to V6.21 or later version SINUMERIK software can be obtained from your local Siemens account manager.

  • FixedSINUMERIK ONEcisa_csaf_ot

    Update to V6.21 or later version SINUMERIK software can be obtained from your local Siemens account manager.

  • MitigationSIMATIC Drive Controller familysiemens_psirt

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)siemens_psirt

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC S7-1500 Software Controllersiemens_psirt

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSINUMERIK MCsiemens_psirt

    Expose the communication between the S7-1500 CPU and the HMI of the affected products only to trusted network environments

  • MitigationSINUMERIK ONEsiemens_psirt

    Expose the communication between the S7-1500 CPU and the HMI of the affected products only to trusted network environments

  • MitigationSIMATIC Drive Controller familycisa_csaf_ot

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)cisa_csaf_ot

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC S7-1500 Software Controllercisa_csaf_ot

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSIMATIC S7-PLCSIM Advancedcisa_csaf_ot

    Protect access to the TIA Portal project and CPU (including related memory cards) from unauthorized actors

  • MitigationSINUMERIK MCcisa_csaf_ot

    Expose the communication between the S7-1500 CPU and the HMI of the affected products only to trusted network environments

  • MitigationSINUMERIK ONEcisa_csaf_ot

    Expose the communication between the S7-1500 CPU and the HMI of the affected products only to trusted network environments

  • No fix plannedSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • No fix plannedSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)cisa_csaf_ot

    Currently no fix is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

9.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.1–9.3

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9
v3.19.3criticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.19.3criticalAV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.3criticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · ENISA EU
v3.19.3criticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · productcert@siemens.com DEexploitability 2.5 · impact 6
v3.19.3criticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-522USCWE-522USCWE-522USCWE-522US
05

affected products (81)

Products and version ranges known to be affected.

showing 20 of 81
06

advisories (4)

Vendor and ecosystem advisories describing this.

  • SSA-568427SSA-568427: Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families2022-10-11csaf · siemens_psirtDE

    SIMATIC S7-1200, S7-1500 CPUs and related products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication. Siemens recommends to update both the affected products as well as the corresponding TIA Portal project to the latest versions. TIA Portal V17 and related CPU firmware versions introduced protection of confidential configuration data based on individual passwords per device and TLS-protected PG/PC and HMI communication. Additional details can be found in the related Siemens security bulletin SSB-898115 ( https://cert-portal.siemens.com/productcert/html/ssb-898115.html).

  • SSA-568428SSA-568428: Weak Key Protection Vulnerability in SINUMERIK ONE and SINUMERIK MC2022-11-08csaf · siemens_psirtDE

    SINUMERIK ONE and SINUMERIK MC products are affected by a weak key protection vulnerability in the integrated S7-1500 CPU. The weak key protection vulnerability in the integrated S7-1500 CPU is documented in more detail in SSA-568427 [1]. Siemens has released updates for the affected products and recommends to update to the latest versions. [1] https://cert-portal.siemens.com/productcert/html/ssa-568427.html

  • ICSA-22-286-04Siemens SIMATIC S7-1200 and S7-1500 CPU Families2022-10-11icsa · cisa_csaf_otUS

    SIMATIC S7-1200, S7-1500 CPUs and related products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication. Siemens recommends to update both the affected products as well as the corresponding TIA Portal project to the latest versions. TIA Portal V17 and related CPU firmware versions introduced protection of confidential configuration data based on individual passwords per device and TLS-protected PG/PC and HMI communication. Additional details can be found in the related Siemens security bulletin SSB-898115 ( https://cert-portal.siemens.com/productcert/html/ssb-898115.html).

  • ICSA-22-314-04Siemens SINUMERIK ONE and SINUMERIK MC2022-11-08icsa · cisa_csaf_otUS

    SINUMERIK ONE and SINUMERIK MC products are affected by a weak key protection vulnerability in the integrated S7-1500 CPU. The weak key protection vulnerability in the integrated S7-1500 CPU is documented in more detail in SSA-568427 [1]. Siemens has released updates for the affected products and recommends to update to the latest versions. [1] https://cert-portal.siemens.com/productcert/html/ssa-568427.html

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otsiemens_psirtNVDCVE.orgMITRE
published 2022-10-11modified 2026-06-17
09

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan