CVE-2015-1358
First published: Wed Feb 18 2015(Updated: )
The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens WinCC | =13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/72625
- http://www.securitytracker.com/id/1036090
- http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf
- https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02
Frequently Asked Questions
What is the severity of CVE-2015-1358?
CVE-2015-1358 is classified as a high severity vulnerability due to improper encryption of credentials.
How do I fix CVE-2015-1358?
To fix CVE-2015-1358, it is recommended to update to the latest version of Siemens SIMATIC WinCC or apply any relevant security patches provided by Siemens.
What products are affected by CVE-2015-1358?
CVE-2015-1358 affects Siemens SIMATIC WinCC versions prior to 13 SP1 and SIMATIC WinCC flexible versions before 2008 SP3 Up7.
What is the impact of CVE-2015-1358?
The impact of CVE-2015-1358 includes the potential compromise of credentials due to insufficient encryption in remote management functions.
Is CVE-2015-1358 actively exploited?
As of the last reports, there is no public information indicating that CVE-2015-1358 has been actively exploited.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens wincc
- version/siemens wincc/13.0