peter bassill · operator
$ cve CVE-2020-15798 JSON

CVE-2020-15798

9.8
CRITICAL · CVSS 3.1 · EPSS 5.2% (pctl 92)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS5.22% — more likely to be exploited than 92% of all CVEs
WeaknessCWE-306
On CISA KEVno
Public exploitnone known
Published2021-02-09
Last modified2026-06-17

Affected (20)

VendorProduct
siemenssimatic hmi comfort panels
siemenssimatic hmi comfort panels firmware
siemenssimatic hmi ktp mobile panels
siemenssimatic hmi ktp mobile panels firmware
siemenssinamics gh150
siemenssinamics gh150 firmware
siemenssinamics gl150
siemenssinamics gl150 firmware
siemenssinamics gm150
siemenssinamics gm150 firmware
siemenssinamics sh150
siemenssinamics sh150 firmware
siemenssinamics sl150
siemenssinamics sl150 firmware
siemenssinamics sm120
siemenssinamics sm120 firmware
siemenssinamics sm150
siemenssinamics sm150 firmware
siemenssinamics sm150i
siemenssinamics sm150i firmware

References

→ the Explorer  ·  watch your stack  ·  NVD