Read the docs
TI-2019-04626 Aliases CVE-2019-6572GHSA-q833-7p8r-rcqc

Information disclosure in Siemens SIMATIC HMI Comfort Panels 4" - 22"

Priority MEDIUM 44CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200 and CWE-798.

Summary

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The affected device offered SNMP read and write capacities with a publicly know hardcoded community string. The security vulnerability could be exploited by an attacker with network access to the affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Why it matters now

EPSS 0.02721 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC HMI Comfort Panels 4" - 22"All versions < V15.1 Update 1—No fix listedCNA
SiemensSIMATIC HMI Comfort Outdoor Panels 7" & 15"All versions < V15.1 Update 1—No fix listedCNA
SiemensSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900FAll versions < V15.1 Update 1—No fix listedCNA
SiemensSIMATIC WinCC Runtime AdvancedAll versions < V15.1 Update 1—No fix listedCNA
SiemensSIMATIC WinCC Runtime ProfessionalAll versions < V15.1 Update 1—No fix listedCNA
SiemensSIMATIC WinCC (TIA Portal)All versions < V15.1 Update 1—No fix listedCNA
SiemensSIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)All versions—No fix listedCNA
  • SIMATIC HMI Comfort Panels 4" - 22" VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
  • SIMATIC HMI Comfort Outdoor Panels 7" & 15" VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
  • SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Advanced VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Professional VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
  • SIMATIC WinCC (TIA Portal) VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
  • SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) VendorSiemens Affected All versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:*before 15.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:*before 15.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_comfort_outdoor_panels:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp400f_firmware:*:*:*:*:*:*:*:*before 15.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp400f:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700_firmware:*:*:*:*:*:*:*:*before 15.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700f_firmware:*:*:*:*:*:*:*:*before 15.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700f:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_comfort_outdoor_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp400f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp400f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900_firmware:*:*:*:*:*:*:*:*before 15.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900f_firmware:*:*:*:*:*:*:*:*before 15.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900f:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):*:*:*:*:*:*:*:*before 15.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:*before 15.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:*before 15.1VulnerableSiemens
cpe:2.3:o:siemens:simatic_hmi_tp_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_tp:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_hmi_mp_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_mp:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_hmi_op_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_hmi_op:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* Versions before 15.1 Vulnerable ·Siemens
  • cpe:2.3:o:siemens:simatic_hmi_tp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_tp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_hmi_mp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_mp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_hmi_op_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_hmi_op:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-6572
  2. 2026-10-03 Alias added: GHSA-q833-7p8r-rcqc

References

Advisory 2

  • TI-2021-02413 NULL pointer deref in signature_algorithms processing CVSS 3.1MEDIUM 5.9
  • TI-2019-04628 Improper handling of exceptional conditions in Siemens SIMATIC CP 443-1 OPC UA CVSS 3.1HIGH 7.5
  • TI-2019-04622 Out-of-bounds read in Siemens SIMATIC CP 1604 CVSS 3.1HIGH 7.5
  • TI-2018-10025 HTTP response splitting in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI… CVSS 3.0HIGH 8.8
  • TI-2018-10024 Open redirect in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor… CVSS 3.0HIGH 8.1
  • TI-2018-10023 Path traversal in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort… CVSS 3.0HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences