Riskcovery

CVE-2020-15798

State
Published
Severity
9.8 Critical
Published
Feb 9, 2021
Updated
Jun 2, 2026
Reserved
Jul 15, 2020

Read the record on cve.org

Description

A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-306 Missing Authentication for Critical Function

Affected Products

ProductVersions
SIMATIC HMI Comfort Panels (incl. SIPLUS variants)Siemens
  • All versions < V16 Update 3aAffected
SIMATIC HMI KTP Mobile PanelsSiemens
  • All versions < V16 Update 3aAffected
SINAMICS GH150Siemens
  • All versionsAffected
SINAMICS GL150 (with option X30)Siemens
  • All versionsAffected
SINAMICS GM150 (with option X30)Siemens
  • All versionsAffected
SINAMICS SH150Siemens
  • All versionsAffected
SINAMICS SL150Siemens
  • All versionsAffected
SINAMICS SM120Siemens
  • All versionsAffected
SINAMICS SM150Siemens
  • All versionsAffected
SINAMICS SM150iSiemens
  • All versionsAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.