CVE-2015-1602: Infoleak
Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) web-server passwords by leveraging the ability to read these files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1602?
CVE-2015-1602 has been rated as a medium-severity vulnerability due to improper password data storage.
How do I fix CVE-2015-1602?
To mitigate CVE-2015-1602, users should upgrade to Siemens SIMATIC STEP 7 version 13 SP1 Upd1 or later.
What are the potential impacts of CVE-2015-1602?
The potential impacts of CVE-2015-1602 include unauthorized access to cleartext passwords, which may lead to further exploitation.
Which versions of Siemens SIMATIC STEP 7 are affected by CVE-2015-1602?
CVE-2015-1602 affects Siemens SIMATIC STEP 7 versions 12.0 and 13.0 before service pack 1 update 1.
Can local users exploit CVE-2015-1602?
Yes, local users can exploit CVE-2015-1602 by accessing project files that improperly store sensitive password data.