PT-2021-19246 · Siemens · Sinamics Sl150+3

Published 2021-06-28 · Updated 2025-11-22 · CVE-2021-31337

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels (affected versions not specified) SINAMICS SL150: All versions SINAMICS SM150: All versions SINAMICS SM150i: All versions

Description The issue concerns the Telnet service of the SIMATIC HMI Comfort Panels system component, which does not require authentication. This may allow a remote attacker to gain access to the device if the Telnet service is enabled.

Recommendations For SIMATIC HMI Comfort Panels, ensure the Telnet service is disabled to prevent unauthorized access. For SINAMICS SL150, SINAMICS SM150, and SINAMICS SM150i, no action is required since Telnet is disabled by default.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-31337

Affected Products

Simatic Hmi Comfort Panels

Sinamics Sl150

Sinamics Sm150

Sinamics Sm150I

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-31337 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-131-04 · Note
• https://twitter.com/SecureThisNow/status/1992031732905005434 · Twitter Post