HTTP response splitting in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI…
Priority MEDIUM 41CWE-113Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V14), SIMATIC WinCC Runtime Advanced (All versions < V14), SIMATIC WinCC Runtime Professional (All versions < V14), SIMATIC WinCC (TIA Portal) (All versions < V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Why it matters now
EPSS 0.01684 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) | SIMATIC HMI Comfort Panels 4" - 22" : All versions < V14; SIMATIC HMI Comfort Outdoor Panels 7" & 15" : All versions < V14; SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions < V14; SIMATIC WinCC Runtime Advanced : All versions < V14; SIMATIC WinCC Runtime Professional : All versions < V14; SIMATIC WinCC (TIA Portal) : All versions < V14; SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions | — | No fix listed | CNA |
- SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) VendorSiemens Affected SIMATIC HMI Comfort Panels 4" - 22" : All versions < V14; SIMATIC HMI Comfort Outdoor Panels 7" & 15" : All versions < V14; SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions < V14; SIMATIC WinCC Runtime Advanced : All versions < V14; SIMATIC WinCC Runtime Professional : All versions < V14; SIMATIC WinCC (TIA Portal) : All versions < V14; SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_comfort_outdoor_panels:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp400f_firmware:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp400f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700_firmware:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700f_firmware:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_comfort_outdoor_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp400f_firmware:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp400f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700_firmware:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700f_firmware:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900_firmware:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900f_firmware:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* | before 14.0 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_tp_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_tp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_mp_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_mp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_op_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_op:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900_firmware:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900f_firmware:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* Versions before 14.0 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_tp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_tp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_mp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_mp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_op_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_op:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-13814
- 2026-10-03 Alias added: GHSA-gvqw-466j-w6vp
References
More Siemens Simatic Hmi Comfort Outdoor Panels Firmware vulnerabilities
- TI-2021-02413 NULL pointer deref in signature_algorithms processing CVSS 3.1MEDIUM 5.9
- TI-2019-04626 Information disclosure in Siemens SIMATIC HMI Comfort Panels 4" - 22" CVSS 3.1CRITICAL 9.1
- TI-2019-04628 Improper handling of exceptional conditions in Siemens SIMATIC CP 443-1 OPC UA CVSS 3.1HIGH 7.5
- TI-2019-04622 Out-of-bounds read in Siemens SIMATIC CP 1604 CVSS 3.1HIGH 7.5
- TI-2018-10024 Open redirect in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor… CVSS 3.0HIGH 8.1
- TI-2018-10023 Path traversal in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort… CVSS 3.0HIGH 7.5
Sources
- CVE-2018-13814 · CVE Program
- CVE-2018-13814 · NVD
- FIRST EPSS
- GHSA-gvqw-466j-w6vp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences