Broken or risky cryptographic algorithm in Siemens SIMATIC CP 1626
Priority LOW 28CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-327.
Summary
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC HMI Panel (incl. SIPLUS variants) (All versions), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.4.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.8.1), SIMATIC S7-1500 Software Controller (All versions < V20.8), SIMATIC S7-PLCSIM Advanced (All versions < V3.0), SIMATIC STEP 7 (TIA Portal) (All versions < V16), SIMATIC WinCC (TIA Portal) (All versions < V16), SIMATIC WinCC OA (All versions < V3.16 P013), SIMATIC WinCC Runtime Advanced (All versions < V16), SIMATIC WinCC Runtime Professional (All versions < V16), TIM 1531 IRC (incl. SIPLUS NET variants) (All versions < V2.1). Affected devices contain a message protection bypass vulnerability due to certain properties in the calculation used for integrity protection. This could allow an attacker in a Man-in-the-Middle position to modify network traffic sent on port 102/tcp to the affected devices.
Why it matters now
EPSS 0.00978 62nd percentileScored 2026-11-07
Fix Fixed SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (Siemens): V20.8SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Siemens): V4.4.0+8 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC CP 1626 | All versions | — | No fix listed | CNA |
| Siemens | SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) | All versions | — | No fix listed | CNA |
| Siemens | SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) | before V20.8 | V20.8 | Patch available | CNA |
| Siemens | SIMATIC HMI Panel (incl. SIPLUS variants) | All versions | — | No fix listed | CNA |
| Siemens | SIMATIC NET PC Software V14 | All versions < V14 SP1 Update 14 | — | No fix listed | CNA |
| Siemens | SIMATIC NET PC Software V15 | All versions | — | No fix listed | CNA |
| Siemens | SIMATIC S7-1200 CPU family (incl. SIPLUS variants) | before V4.4.0 | V4.4.0 | Patch available | CNA |
| Siemens | SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) | before V2.8.1 | V2.8.1 | Patch available | CNA |
| Siemens | SIMATIC S7-1500 Software Controller | before V20.8 | V20.8 | Patch available | CNA |
| Siemens | SIMATIC S7-PLCSIM Advanced | before V3.0 | V3.0 | Patch available | CNA |
| Siemens | SIMATIC STEP 7 (TIA Portal) | before V16 | V16 | Patch available | CNA |
| Siemens | SIMATIC WinCC (TIA Portal) | before V16 | V16 | Patch available | CNA |
| Siemens | SIMATIC WinCC OA | All versions < V3.16 P013 | — | No fix listed | CNA |
| Siemens | SIMATIC WinCC Runtime Advanced | before V16 | V16 | Patch available | CNA |
| Siemens | SIMATIC WinCC Runtime Professional | before V16 | V16 | Patch available | CNA |
| Siemens | TIM 1531 IRC (incl. SIPLUS NET variants) | before V2.1 | V2.1 | Patch available | CNA |
- SIMATIC CP 1626 VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) VendorSiemens Affected before V20.8 Fixed in V20.8 Patch available CNA
- SIMATIC HMI Panel (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIMATIC NET PC Software V14 VendorSiemens Affected All versions < V14 SP1 Update 14 Fixed in — No fix listed CNA
- SIMATIC NET PC Software V15 VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIMATIC S7-1200 CPU family (incl. SIPLUS variants) VendorSiemens Affected before V4.4.0 Fixed in V4.4.0 Patch available CNA
- SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) VendorSiemens Affected before V2.8.1 Fixed in V2.8.1 Patch available CNA
- SIMATIC S7-1500 Software Controller VendorSiemens Affected before V20.8 Fixed in V20.8 Patch available CNA
- SIMATIC S7-PLCSIM Advanced VendorSiemens Affected before V3.0 Fixed in V3.0 Patch available CNA
- SIMATIC STEP 7 (TIA Portal) VendorSiemens Affected before V16 Fixed in V16 Patch available CNA
- SIMATIC WinCC (TIA Portal) VendorSiemens Affected before V16 Fixed in V16 Patch available CNA
- SIMATIC WinCC OA VendorSiemens Affected All versions < V3.16 P013 Fixed in — No fix listed CNA
- SIMATIC WinCC Runtime Advanced VendorSiemens Affected before V16 Fixed in V16 Patch available CNA
- SIMATIC WinCC Runtime Professional VendorSiemens Affected before V16 Fixed in V16 Patch available CNA
- TIM 1531 IRC (incl. SIPLUS NET variants) VendorSiemens Affected before V2.1 Fixed in V2.1 Patch available CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1200_cpu_1211c_firmware:*:*:*:*:*:*:*:* | up to 4.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1200_cpu_1211c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1200_cpu_1212c_firmware:*:*:*:*:*:*:*:* | up to 4.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1200_cpu_1212c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1200_cpu_1214c_firmware:*:*:*:*:*:*:*:* | up to 4.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1200_cpu_1214c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1200_cpu_1211c_firmware:*:*:*:*:*:*:*:* Versions up to 4.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1200_cpu_1211c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1200_cpu_1212c_firmware:*:*:*:*:*:*:*:* Versions up to 4.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1200_cpu_1212c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1200_cpu_1214c_firmware:*:*:*:*:*:*:*:* Versions up to 4.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1200_cpu_1214c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_s7-1200_cpu_1215c_firmware:*:*:*:*:*:*:*:* | up to 4.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1200_cpu_1215c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1200_cpu_1217c_firmware:*:*:*:*:*:*:*:* | up to 4.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1200_cpu_1217c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511c_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1500_cpu_1511c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1500_cpu_1512c_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1500_cpu_1512c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:a:siemens:simatic_net_pc:*:*:*:*:*:*:*:* | before 16 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_s7-1500:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_s7-plcsim_advanced:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:* | before 16 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:* | before 16 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_open_architecture:*:*:*:*:*:*:*:* | up to 3.15 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_open_architecture:3.16:-:*:*:*:*:*:* | 3.16 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_open_architecture:3.16:patch_12:*:*:*:*:*:* | 3.16 patch_12 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1626_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1626:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_tim_1531_irc_firmware:*:*:*:*:*:*:*:* | before 2.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_tim_1531_irc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_panel_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_panel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_s7-1200_cpu_1215c_firmware:*:*:*:*:*:*:*:* Versions up to 4.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1200_cpu_1215c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1200_cpu_1217c_firmware:*:*:*:*:*:*:*:* Versions up to 4.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1200_cpu_1217c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511c_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1500_cpu_1511c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1500_cpu_1512c_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1500_cpu_1512c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:a:siemens:simatic_net_pc:*:*:*:*:*:*:*:* Versions before 16 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_s7-1500:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_s7-plcsim_advanced:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:* Versions before 16 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:* Versions before 16 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_open_architecture:*:*:*:*:*:*:*:* Versions up to 3.15 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_open_architecture:3.16:-:*:*:*:*:*:* Versions 3.16 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_open_architecture:3.16:patch_12:*:*:*:*:*:* Versions 3.16 patch_12 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:advanced:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_wincc_runtime:*:*:*:*:professional:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1626_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1626:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_tim_1531_irc_firmware:*:*:*:*:*:*:*:* Versions before 2.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_tim_1531_irc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_panel_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_panel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (Siemens) Fixed in V20.8
- Fix · CNA SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Siemens) Fixed in V4.4.0
- Fix · CNA SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (Siemens) Fixed in V2.8.1
- Fix · CNA SIMATIC S7-1500 Software Controller (Siemens) Fixed in V20.8
- Fix · CNA SIMATIC S7-PLCSIM Advanced (Siemens) Fixed in V3.0
- Fix · CNA SIMATIC STEP 7 (TIA Portal) (Siemens) Fixed in V16
- Fix · CNA SIMATIC WinCC (TIA Portal) (Siemens) Fixed in V16
- Fix · CNA SIMATIC WinCC Runtime Advanced (Siemens) Fixed in V16
- Fix · CNA SIMATIC WinCC Runtime Professional (Siemens) Fixed in V16
- Fix · CNA TIM 1531 IRC (incl. SIPLUS NET variants) (Siemens) Fixed in V2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10929
- 2026-10-03 Alias added: GHSA-77j2-3682-mqmj
References
More Siemens Simatic Cp 1626 Firmware vulnerabilities
- TI-2017-01922 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1
- TI-2023-18827 Improper access control in Siemens SIMATIC CP 1604 CVSS 3.1MEDIUM 6.7
- TI-2023-18828 Uncontrolled resource consumption in Siemens SIMATIC CP 1604 CVSS 3.1MEDIUM 4.4
Sources
- CVE-2019-10929 · CVE Program
- CVE-2019-10929 · NVD
- FIRST EPSS
- GHSA-77j2-3682-mqmj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences