Cross-site scripting in Siemens SIMATIC HMI Comfort Panels 4" - 22"
Priority LOW 26CWE-80Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-80.
Summary
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify particular parts of the device configuration via SNMP. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires system privileges and user interaction. An attacker could use the vulnerability to compromise confidentiality and the integrity of the affected system. At the stage of publishing this security advisory no public exploitation is known.
Why it matters now
EPSS 0.00876 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC HMI Comfort Panels 4" - 22" | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC HMI Comfort Outdoor Panels 7" & 15" | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC WinCC Runtime Advanced | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC WinCC Runtime Professional | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC WinCC (TIA Portal) | All versions < V15.1 Update 1 | — | No fix listed | CNA |
| Siemens | SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) | All versions | — | No fix listed | CNA |
- SIMATIC HMI Comfort Panels 4" - 22" VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC HMI Comfort Outdoor Panels 7" & 15" VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC WinCC Runtime Advanced VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC WinCC Runtime Professional VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC WinCC (TIA Portal) VendorSiemens Affected All versions < V15.1 Update 1 Fixed in — No fix listed CNA
- SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_comfort_outdoor_panels:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp400f_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp400f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700f_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_comfort_outdoor_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp400f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp400f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp700f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp700f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900f_firmware:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_tp_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_tp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_mp_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_mp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_op_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_op:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_ktp900f_firmware:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels_ktp900f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_tp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_tp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_mp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_mp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_op_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_op:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-6577
- 2026-10-03 Alias added: GHSA-cxq5-q43p-whjh
References
More Siemens Simatic Hmi Comfort Outdoor Panels Firmware vulnerabilities
- TI-2021-02413 NULL pointer deref in signature_algorithms processing CVSS 3.1MEDIUM 5.9
- TI-2019-04626 Information disclosure in Siemens SIMATIC HMI Comfort Panels 4" - 22" CVSS 3.1CRITICAL 9.1
- TI-2019-04628 Improper handling of exceptional conditions in Siemens SIMATIC CP 443-1 OPC UA CVSS 3.1HIGH 7.5
- TI-2019-04622 Out-of-bounds read in Siemens SIMATIC CP 1604 CVSS 3.1HIGH 7.5
- TI-2018-10025 HTTP response splitting in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI… CVSS 3.0HIGH 8.8
- TI-2018-10024 Open redirect in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor… CVSS 3.0HIGH 8.1
Sources
- CVE-2019-6577 · CVE Program
- CVE-2019-6577 · NVD
- FIRST EPSS
- GHSA-cxq5-q43p-whjh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences