Cryptographic flaw in Siemens SIMATIC HMI Comfort Panels 4" - 22"
Priority LOW 32CWE-310Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). An attacker with network access to affected devices could potentially obtain a TLS session key. If the attacker is able to observe TLS traffic between a legitimate user and the device, then the attacker could decrypt the TLS traffic. The security vulnerability could be exploited by an attacker who has network access to the web interface of the device and who is able to observe TLS traffic between legitimate users and the web interface of the affected device. The vulnerability could impact the confidentiality of the communication between the affected device and a legitimate user. At the time of advisory publication no public exploitation of the security vulnerability was known.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01783 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC HMI Comfort Panels 4" - 22" | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC HMI Comfort Outdoor Panels 7" & 15" | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC WinCC Runtime Advanced | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC WinCC Runtime Professional | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC WinCC (TIA Portal) | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) | All versions | — | No fix listed | CNA |
- SIMATIC HMI Comfort Panels 4" - 22" VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC HMI Comfort Outdoor Panels 7" & 15" VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC WinCC Runtime Advanced VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC WinCC Runtime Professional VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC WinCC (TIA Portal) VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_comfort_outdoor_panels:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp400f_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp400f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700f_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_comfort_outdoor_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp400f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp400f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900f_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_tp_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_tp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_mp_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_mp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_op_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_op:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_tp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_tp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_mp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_mp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_op_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_op:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-6576
- 2026-10-03 Alias added: GHSA-6vg7-p7hj-4575
References
More Siemens Simatic Hmi Comfort Outdoor Panels Firmware vulnerabilities
- TI-2021-02413 NULL pointer deref in signature_algorithms processing CVSS 3.1MEDIUM 5.9
- TI-2019-04626 Information disclosure in Siemens SIMATIC HMI Comfort Panels 4" - 22" CVSS 3.1CRITICAL 9.1
- TI-2019-04628 Improper handling of exceptional conditions in Siemens SIMATIC CP 443-1 OPC UA CVSS 3.1HIGH 7.5
- TI-2019-04622 Out-of-bounds read in Siemens SIMATIC CP 1604 CVSS 3.1HIGH 7.5
- TI-2018-10025 HTTP response splitting in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI… CVSS 3.0HIGH 8.8
- TI-2018-10024 Open redirect in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor… CVSS 3.0HIGH 8.1
Sources
- CVE-2019-6576 · CVE Program
- CVE-2019-6576 · NVD
- FIRST EPSS
- GHSA-6vg7-p7hj-4575 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences