Riskcovery

CVE-2020-28397

State
Published
Severity
Not scored
Published
Aug 10, 2021
Updated
Aug 4, 2024
Reserved
Nov 10, 2020

Read the record on cve.org

Description

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7 PLCSIM Advanced (All versions > V2 < V4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Version V4.4), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions > V2.5 < V2.9.2), SIMATIC S7-1500 Software Controller (All versions > V2.5 < V21.9), TIM 1531 IRC (incl. SIPLUS NET variants) (Version V2.1). Due to an incorrect authorization check in the affected component, an attacker could extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once.

Scores

The record has no CVSS score.

Weaknesses

Affected Products

ProductVersions
SIMATIC Drive Controller familySiemens
  • All versions < V2.9.2Affected
SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)Siemens
  • All versions < V21.9Affected
SIMATIC S7 PLCSIM AdvancedSiemens
  • All versions > V2 < V4Affected
SIMATIC S7-1200 CPU family (incl. SIPLUS variants)Siemens
  • Version V4.4Affected
SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)Siemens
  • All versions > V2.5 < V2.9.2Affected
SIMATIC S7-1500 Software ControllerSiemens
  • All versions > V2.5 < V21.9Affected
TIM 1531 IRC (incl. SIPLUS NET variants)Siemens
  • Version V2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.