Missing authentication in Siemens SIMATIC HMI Comfort Panels
Priority MEDIUM 57CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-306.
Summary
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05262 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC HMI Comfort Panels (incl. SIPLUS variants) | All versions < V16 Update 3a | — | No fix listed | CNA |
| Siemens | SIMATIC HMI KTP Mobile Panels | All versions < V16 Update 3a | — | No fix listed | CNA |
| Siemens | SINAMICS GH150 | All versions | — | No fix listed | CNA |
| Siemens | SINAMICS GL150 (with option X30) | All versions | — | No fix listed | CNA |
| Siemens | SINAMICS GM150 (with option X30) | All versions | — | No fix listed | CNA |
| Siemens | SINAMICS SH150 | All versions | — | No fix listed | CNA |
| Siemens | SINAMICS SL150 | All versions | — | No fix listed | CNA |
| Siemens | SINAMICS SM120 | All versions | — | No fix listed | CNA |
| Siemens | SINAMICS SM150 | All versions | — | No fix listed | CNA |
| Siemens | SINAMICS SM150i | All versions | — | No fix listed | CNA |
- SIMATIC HMI Comfort Panels (incl. SIPLUS variants) VendorSiemens Affected All versions < V16 Update 3a Fixed in — No fix listed CNA
- SIMATIC HMI KTP Mobile Panels VendorSiemens Affected All versions < V16 Update 3a Fixed in — No fix listed CNA
- SINAMICS GH150 VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINAMICS GL150 (with option X30) VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINAMICS GM150 (with option X30) VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINAMICS SH150 VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINAMICS SL150 VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINAMICS SM120 VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINAMICS SM150 VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINAMICS SM150i VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* | before 16.0 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:-:*:*:*:*:*:* | 16.0 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update1:*:*:*:*:*:* | 16.0 update1 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update2:*:*:*:*:*:* | 16.0 update2 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update3:*:*:*:*:*:* | 16.0 update3 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:*:*:*:*:*:*:*:* | before 16.0 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:-:*:*:*:*:*:* | 16.0 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update1:*:*:*:*:*:* | 16.0 update1 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update2:*:*:*:*:*:* | 16.0 update2 | Vulnerable | Siemens |
- cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:*:*:*:*:*:*:*:* Versions before 16.0 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:-:*:*:*:*:*:* Versions 16.0 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update1:*:*:*:*:*:* Versions 16.0 update1 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update2:*:*:*:*:*:* Versions 16.0 update2 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_comfort_panels_firmware:16.0:update3:*:*:*:*:*:* Versions 16.0 update3 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_comfort_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:*:*:*:*:*:*:*:* Versions before 16.0 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:-:*:*:*:*:*:* Versions 16.0 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update1:*:*:*:*:*:* Versions 16.0 update1 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update2:*:*:*:*:*:* Versions 16.0 update2 Vulnerable ·Siemens
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update3:*:*:*:*:*:* | 16.0 update3 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinamics_gh150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinamics_gh150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinamics_gl150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinamics_gl150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinamics_gm150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinamics_gm150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinamics_sh150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinamics_sh150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinamics_sl150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinamics_sl150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinamics_sm150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinamics_sm150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinamics_sm120_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinamics_sm120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinamics_sm150i_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinamics_sm150i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:16.0:update3:*:*:*:*:*:* Versions 16.0 update3 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_hmi_ktp_mobile_panels:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinamics_gh150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinamics_gh150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinamics_gl150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinamics_gl150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinamics_gm150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinamics_gm150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinamics_sh150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinamics_sh150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinamics_sl150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinamics_sl150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinamics_sm150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinamics_sm150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinamics_sm120_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinamics_sm120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinamics_sm150i_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinamics_sm150i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15798
- 2026-10-03 Alias added: GHSA-p3v5-8v5r-qgp2
References
More Siemens Simatic Hmi Comfort Panels Firmware vulnerabilities
- TI-2020-12421 Missing brute-force protection in Siemens SIMATIC HMI Basic Panels 2nd Generation CVSS 3.1CRITICAL 9.8
- TI-2019-04626 Information disclosure in Siemens SIMATIC HMI Comfort Panels 4" - 22" CVSS 3.1CRITICAL 9.1
- TI-2019-04622 Out-of-bounds read in Siemens SIMATIC CP 1604 CVSS 3.1HIGH 7.5
- TI-2022-19090 Improper input validation in Siemens SIMATIC HMI Comfort Panels CVSS 3.1HIGH 7.5
- TI-2018-10025 HTTP response splitting in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI… CVSS 3.0HIGH 8.8
- TI-2018-10024 Open redirect in Siemens SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor… CVSS 3.0HIGH 8.1
Sources
- CVE-2020-15798 · CVE Program
- CVE-2020-15798 · NVD
- FIRST EPSS
- GHSA-p3v5-8v5r-qgp2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences