PT-2015-1807 · Siemens · Simatic Hmi Basic Panels 2Nd Generation+8

Ilya Karpov

·

Published

2015-04-08

·

Updated

2016-11-28

·

CVE-2015-2823

CVSS v2.0

6.8

Medium

VectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Siemens SIMATIC HMI Basic Panels 2nd Generation versions prior to WinCC (TIA Portal) 13 SP1 Upd2 Siemens SIMATIC HMI Comfort Panels versions prior to WinCC (TIA Portal) 13 SP1 Upd2 Siemens SIMATIC WinCC Runtime Advanced versions prior to WinCC (TIA Portal) 13 SP1 Upd2 Siemens SIMATIC WinCC Runtime Professional versions prior to WinCC (TIA Portal) 13 SP1 Upd2 Siemens SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal) Siemens SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal) Siemens SIMATIC HMI Multi Panels (WinCC TIA Portal) Siemens SIMATIC WinCC 7.x versions prior to 7.3 Upd4
Description The issue is related to weaknesses in the password checking procedure of the software, allowing remote attackers to complete authentication by leveraging knowledge of a password hash without knowledge of the associated password. This can enable a remote attacker to successfully pass authentication using a user's password hash value.
Recommendations For Siemens SIMATIC HMI Basic Panels 2nd Generation versions prior to WinCC (TIA Portal) 13 SP1 Upd2, update to WinCC (TIA Portal) 13 SP1 Upd2 or later. For Siemens SIMATIC HMI Comfort Panels versions prior to WinCC (TIA Portal) 13 SP1 Upd2, update to WinCC (TIA Portal) 13 SP1 Upd2 or later. For Siemens SIMATIC WinCC Runtime Advanced versions prior to WinCC (TIA Portal) 13 SP1 Upd2, update to WinCC (TIA Portal) 13 SP1 Upd2 or later. For Siemens SIMATIC WinCC Runtime Professional versions prior to WinCC (TIA Portal) 13 SP1 Upd2, update to WinCC (TIA Portal) 13 SP1 Upd2 or later. For Siemens SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal), Siemens SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal), and Siemens SIMATIC HMI Multi Panels (WinCC TIA Portal), consider disabling remote authentication until a patch is available. For Siemens SIMATIC WinCC 7.x versions prior to 7.3 Upd4, update to 7.3 Upd4 or later.

Fix

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2015-11153
CVE-2015-2823

Affected Products

Simatic Hmi Basic Panels 1St Generation
Simatic Hmi Basic Panels 2Nd Generation
Simatic Hmi Comfort Panels
Simatic Hmi Mobile Panel 277
Simatic Hmi Multi Panels
Simatic Wincc 7.X
Simatic Wincc Runtime Advanced
Simatic Wincc Runtime Professional
Wincc