CVE-2019-6576
published 2019-05-14CVE-2019-6576: A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All…
PriorityP434medium6.5CVSS 3.1
AVAACLPRNUINSUCHINAN
EPSS
1.74%
75.2th percentile
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). An attacker with network access to affected devices could potentially obtain a TLS session key. If the attacker is able to observe TLS traffic between a legitimate user and the device, then the attacker could decrypt the TLS traffic. The security vulnerability could be exploited by an attacker who has network access to the web interface of the device and who is able to observe TLS traffic between legitimate users and the web interface of the affected device. The vulnerability could impact the confidentiality of the communication between the affected device and a legitimate user. At the time of advisory publication no public exploitation of the security vulnerability was known.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | simatic_hmi_comfort_outdoor_panels_firmware | < 15.1 | 15.1 |
| siemens | simatic_hmi_comfort_panels_firmware | < 15.1 | 15.1 |
| siemens | simatic_hmi_ktp_mobile_panels_ktp400f_firmware | < 15.1 | 15.1 |
| siemens | simatic_hmi_ktp_mobile_panels_ktp700_firmware | < 15.1 | 15.1 |
| siemens | simatic_hmi_ktp_mobile_panels_ktp700f_firmware | < 15.1 | 15.1 |
| siemens | simatic_hmi_ktp_mobile_panels_ktp900_firmware | < 15.1 | 15.1 |
| siemens | simatic_hmi_ktp_mobile_panels_ktp900f_firmware | < 15.1 | 15.1 |
| siemens | simatic_wincc | < 15.1 | 15.1 |
| siemens | simatic_wincc_runtime | < 15.1 | 15.1 |
| siemens_ag | simatic_hmi_classic_devices | — | — |
| siemens_ag | simatic_hmi_comfort_outdoor_panels_7_15 | — | — |
| siemens_ag | simatic_hmi_comfort_panels_4_22 | — | — |
| siemens_ag | simatic_wincc | — | — |
| siemens_ag | simatic_wincc_runtime_advanced | — | — |
| siemens_ag | simatic_wincc_runtime_professional | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Siemens SIMATIC HMI Comfort Panel TLS Session Key cryptographic issue (ssa-804486 / BID-108412)
vuldb·2026-06-03·CVSS 6.5
CVE-2019-6576 [MEDIUM] Siemens SIMATIC HMI Comfort Panel TLS Session Key cryptographic issue (ssa-804486 / BID-108412)
A vulnerability was found in Siemens SIMATIC HMI Comfort Panel, SIMATIC HMI Comfort Outdoor Panel, SIMATIC HMI KTP Mobile Panel and SIMATIC WinCC and classified as problematic. Affected by this issue is some unknown functionality of the component TLS Session Key Handler. The manipulation results in cryptographic issues.
This vulnerability was named CVE-2019-6576. The attack may be performed from remote. There is no available exploit.
GHSA
GHSA-6vg7-p7hj-4575: A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15
ghsa_unreviewed·2022-05-24
CVE-2019-6576 [HIGH] GHSA-6vg7-p7hj-4575: A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). An attacker with network access to affected devices could potentially obtain a TLS session key. If the attacker is able to observe TLS traffic between a legitimate user and the device, then the attacker could decrypt the TLS traffic. The securi
CISA ICS
Siemens SIMATIC Panels and WinCC (TIA Portal)
cisa_ics·2019-05-14·CVSS 9.1
[CRITICAL] Siemens SIMATIC Panels and WinCC (TIA Portal)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SIMATIC Panels and WinCC (TIA Portal)
Last RevisedMay 14, 2019
Alert CodeICSA-19-134-09
## 1. EXECUTIVE SUMMARY
-
CVSS v3 6.5
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Siemens
- Equipment: SIMATIC WinCC Runtime Advanced, WinCC Runtime Professional, WinCC (TIA Portal); HMI Panels
- Vulnerabilities: Use of Hard-coded Credentials, Insufficient Protection of Credentials, Cross-site Scripting
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker with network access to the device to read/write variable
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/108412https://cert-portal.siemens.com/productcert/pdf/ssa-804486.pdfhttps://www.us-cert.gov/ics/advisories/ICSA-19-134-09http://www.securityfocus.com/bid/108412https://cert-portal.siemens.com/productcert/pdf/ssa-804486.pdfhttps://www.us-cert.gov/ics/advisories/ICSA-19-134-09
2019-05-14
Published