Siemens SIMATIC HMI Comfort Panels (incl. SIPLUS variants)

CVE-2020-15798

CRITICAL 9.8

En bref

Source: NVD
EPSS: EPSS 5.20 % · centile 92 (2026-10-31)
État: PUBLISHED
Publiée: 2021-02-09 15:38 UTC
Mise à jour: 2026-06-02 18:59 UTC
Attribuée par: siemens
Statut NVD: Modified

Rechercher sur…

Description

A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)

Faiblesses (CWE)

CWE-306 — Authentification absente sur une fonction critique

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 2.0	HIGH 9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2020-7781
GCVE · GCVE-0-2020-15798

Avis du CERT-FR

CERTFR-2021-AVI-357 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
CERTFR-2021-AVI-068 — Vulnérabilité dans Siemens SIMATIC · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* < 16.0
cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:-:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update1:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update2:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update3:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:*:*:*:*:*:*:*:* < 16.0
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:-:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update1:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update2:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update3:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_gh150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_gl150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_gm150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_sh150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_sl150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_sm150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_sm120_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_sm150i_firmware:-:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Siemens · SIMATIC HMI Comfort Panels (incl. SIPLUS variants)	affected All versions < V16 Update 3a
Siemens · SIMATIC HMI KTP Mobile Panels	affected All versions < V16 Update 3a
Siemens · SINAMICS GH150	affected All versions
Siemens · SINAMICS GL150 (with option X30)	affected All versions
Siemens · SINAMICS GM150 (with option X30)	affected All versions
Siemens · SINAMICS SH150	affected All versions
Siemens · SINAMICS SL150	affected All versions
Siemens · SINAMICS SM120	affected All versions
Siemens · SINAMICS SM150	affected All versions
Siemens · SINAMICS SM150i	affected All versions

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Siemens SIMATIC HMI Comfort Panels (incl. SIPLUS variants)