PT-2015-1807 · Siemens · Simatic Hmi Basic Panels 2Nd Generation+8
Ilya Karpov
·
Published
2015-04-08
·
Updated
2016-11-28
·
CVE-2015-2823
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Siemens SIMATIC HMI Basic Panels 2nd Generation versions prior to WinCC (TIA Portal) 13 SP1 Upd2
Siemens SIMATIC HMI Comfort Panels versions prior to WinCC (TIA Portal) 13 SP1 Upd2
Siemens SIMATIC WinCC Runtime Advanced versions prior to WinCC (TIA Portal) 13 SP1 Upd2
Siemens SIMATIC WinCC Runtime Professional versions prior to WinCC (TIA Portal) 13 SP1 Upd2
Siemens SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal)
Siemens SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal)
Siemens SIMATIC HMI Multi Panels (WinCC TIA Portal)
Siemens SIMATIC WinCC 7.x versions prior to 7.3 Upd4
Description
The issue is related to weaknesses in the password checking procedure of the software, allowing remote attackers to complete authentication by leveraging knowledge of a password hash without knowledge of the associated password. This can enable a remote attacker to successfully pass authentication using a user's password hash value.
Recommendations
For Siemens SIMATIC HMI Basic Panels 2nd Generation versions prior to WinCC (TIA Portal) 13 SP1 Upd2, update to WinCC (TIA Portal) 13 SP1 Upd2 or later.
For Siemens SIMATIC HMI Comfort Panels versions prior to WinCC (TIA Portal) 13 SP1 Upd2, update to WinCC (TIA Portal) 13 SP1 Upd2 or later.
For Siemens SIMATIC WinCC Runtime Advanced versions prior to WinCC (TIA Portal) 13 SP1 Upd2, update to WinCC (TIA Portal) 13 SP1 Upd2 or later.
For Siemens SIMATIC WinCC Runtime Professional versions prior to WinCC (TIA Portal) 13 SP1 Upd2, update to WinCC (TIA Portal) 13 SP1 Upd2 or later.
For Siemens SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal), Siemens SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal), and Siemens SIMATIC HMI Multi Panels (WinCC TIA Portal), consider disabling remote authentication until a patch is available.
For Siemens SIMATIC WinCC 7.x versions prior to 7.3 Upd4, update to 7.3 Upd4 or later.
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simatic Hmi Basic Panels 1St Generation
Simatic Hmi Basic Panels 2Nd Generation
Simatic Hmi Comfort Panels
Simatic Hmi Mobile Panel 277
Simatic Hmi Multi Panels
Simatic Wincc 7.X
Simatic Wincc Runtime Advanced
Simatic Wincc Runtime Professional
Wincc