CVE-2020-15782
published 2021-05-28CVE-2020-15782: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS…
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
5.18%
91.5th percentile
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINAMICS PERFECT HARMONY GH180 Drives (Drives manufactured before 2021-08-13), SINUMERIK MC (All versions < V6.15), SINUMERIK ONE (All versions < V6.15). Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to port 102/tcp could potentially write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | s7-1200_cpu_firmware | < 4.5.0 | 4.5.0 |
| siemens | s7-1500_cpu_firmware | < 2.9.2 | 2.9.2 |
| siemens | simatic_drive_controller_family | — | — |
| siemens | simatic_driver_controller_firmware | < 2.9.2 | 2.9.2 |
| siemens | simatic_et_200sp_open_controller_cpu_1515sp_pc | — | — |
| siemens | simatic_et_200sp_open_controller_cpu_1515sp_pc2 | — | — |
| siemens | simatic_s7-1200_cpu_family | — | — |
| siemens | simatic_s7-1500_cpu_family | — | — |
| siemens | simatic_s7-1500_software_controller | — | — |
| siemens | simatic_s7-plcsim_advanced | < 4.0 | 4.0 |
| siemens | simatic_s7-plcsim_advanced | — | — |
| siemens | sinamics_perfect_harmony_gh180_drives | — | — |
| siemens | sinumerik_mc | — | — |
| siemens | sinumerik_one | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated S7comm/S7comm-plus connections on TCP port 102 targeting Siemens SIMATIC S7-1200/S7-1500 CPUs — exploitation involves a memory protection bypass via a specific operation over this port. ↗
- →Alert on any S7 communication sessions that do not present valid access-protection passwords, or that attempt to use the ENDIS_PW instruction path to bypass client connection controls. ↗
- →Flag S7 communication sessions that do not use TLS (i.e., non-TIA Portal v17 / non-certificate-based sessions) to affected PLCs, as the vulnerability is exploitable over unencrypted S7 protocol. ↗
- →Treat any network access to the S7-1500 CPU display-level access protection interface from untrusted hosts as suspicious; the vulnerability allows bypassing this protection remotely. ↗
- ·CVSS score differs between advisories: NVD/CISA ICS advisories for SINUMERIK and S7 families score it 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the FESTO Didactic republication scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — detection priority should reflect the lower-complexity (AC:L) scenario. ↗
- ·The vulnerability is exploitable remotely with no authentication required; network segmentation of port 102/TCP is the primary compensating control where patching is not yet possible. ↗
- ·SINAMICS PERFECT HARMONY GH180 drives are only affected if the drive internal network is externally connected, which is non-default; verify network topology before treating these as exposed. ↗
- ·No known public exploits specifically targeting this vulnerability were reported at time of advisory publication; however, the attack surface (unauthenticated, network-accessible port 102/TCP) warrants proactive monitoring. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
FESTO Didactic CP, MPS 200, and MPS 400 Firmware
cisa_ics·2025-07-01·CVSS 9.8
[CRITICAL] FESTO Didactic CP, MPS 200, and MPS 400 Firmware
ICS Advisory
##
FESTO Didactic CP, MPS 200, and MPS 400 Firmware
Release DateJuly 01, 2025
Alert CodeICSA-25-182-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: FESTO Didactic
- Equipment: CP, MPS 200, MPS 400
- Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
FESTO Didactic reports that the following products are a
CISA ICS
Siemens SINUMERIK ONE and SINUMERIK MC (Update A)
cisa_ics·2021-07-13·CVSS 9.8
[CRITICAL] Siemens SINUMERIK ONE and SINUMERIK MC (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINUMERIK ONE and SINUMERIK MC (Update A)
Last RevisedSeptember 14, 2021
Alert CodeICSA-21-194-17
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINUMERIK ONE and SINUMERIK MC
- Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-21-194-17 Siemens SINUMERIK ONE and SINUMERIK MC that was published July 13, 2021, to the ICS webpage on us-cert.cisa.gov.
## 2.
CISA ICS
Siemens SINAMICS PERFECT HARMONY GH180 (Update A)
cisa_ics·2021-07-13·CVSS 9.8
[CRITICAL] Siemens SINAMICS PERFECT HARMONY GH180 (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINAMICS PERFECT HARMONY GH180 (Update A)
Last RevisedSeptember 14, 2021
Alert CodeICSA-21-194-13
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINAMICS PERFECT HARMONY GH180
- Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-21-194-13 Siemens SINAMICS PERFECT HARMONY GH180 that was published July 13, 2021, to the ICS webpage on us-cert.cisa.gov.
## 3.
CISA ICS
Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update A)
cisa_ics·2021-06-01
Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update A)
Last RevisedSeptember 14, 2021
Alert CodeICSA-21-152-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely
- Vendor: Siemens
- Equipment: SIMATIC S7-1200 and S7-1500 CPU Families
- Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-21-152-01 Siemens SIMATIC S7-1200 and S7-1500 CPU Families that was published June 1, 2021, on the ICS webpage on us-cert.cisa.gov.
GHSA
GHSA-jx94-83cv-56j7: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2
ghsa_unreviewed·2022-05-24
CVE-2020-15782 [CRITICAL] CWE-119 GHSA-jx94-83cv-56j7: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions), SIMATIC S7-PLCSIM Advanced (All versions < V4.0). Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to port 102/tcp could potentially write arbitrary data and code to protected memory areas or read sensitiv
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf
2021-05-28
Published