CVE-2015-2823 — Improper Authentication in Siemens

Vendor	Product	Version range	Fixed in
siemens	wincc	<= 13.0	—
siemens	wincc	—	—
siemens	wincc	—	—
siemens	wincc	—	—
siemens	wincc	—	—

CISA ICS

Siemens SIMATIC HMI Devices Vulnerabilities

cisa_ics·2018-09-10

Siemens SIMATIC HMI Devices Vulnerabilities ## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. ICS Advisory ## Siemens SIMATIC HMI Devices Vulnerabilities Last RevisedSeptember 10, 2018 Alert CodeICSA-15-099-01 ## OVERVIEW Siemens has identified three vulnerabilities in its SIMATIC HMI devices. These vulnerabilities were reported directly to Siemens by the Quarkslab team and Ilya Karpov from Positive Technologies. Siemens has produced updates that mitigate these vulnerabilities in most of the affected products and are preparing updates for the rest of them. These vulnerabilities could be exploited remotely. ## AFFECTED PRODUCTS The following SIMATIC versions are affected: - SIMATIC H

CISA ICS

Siemens SIMATIC HMI Devices Vulnerabilities (Update E)

cisa_ics·2015-09-10

Siemens SIMATIC HMI Devices Vulnerabilities (Update E) ## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. ICS Advisory ## Siemens SIMATIC HMI Devices Vulnerabilities (Update E) Last RevisedAugust 27, 2018 Alert CodeICSA-15-099-01E ## OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-15-099-01D Siemens SIMATIC HMI Devices Vulnerabilities that was published September 10, 2015, on the NCCIC/ICS‑CERT web site. Siemens has identified three vulnerabilities in its SIMATIC HMI devices. These vulnerabilities were reported directly to Siemens by the Quarkslab team and Ilya Karpov from Positive Technologies. Siemens has produced updates that mitigate these vulnerabilities in a

GHSA

GHSA-5h37-jfgm-xqmg: Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd

ghsa_unreviewed·2022-05-17

CVE-2015-2823 [MEDIUM] CWE-287 GHSA-5h37-jfgm-xqmg: Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC WinCC Runtime Professional before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal), SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal), SIMATIC HMI Multi Panels (WinCC TIA Portal), and SIMATIC WinCC 7.x before 7.3 Upd4 allow remote attackers to complete authentication by leveraging knowledge of a password hash without knowledge of the associated password.

CVE-2015-2823: Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2…

Affected