What’s Vulnerable › Vulnerabilities

CVE-2013-6920

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-12-07 · updated 2026-06-17
• Weakness: CWE-287

Description

Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass intended access restrictions via TCP traffic to port (1) 21 or (2) 23.

Affected products

• Siemens Sinamics G110: all versions
• Siemens Sinamics G110D: all versions
• Siemens Sinamics G120: all versions
• Siemens SINAMICS G120C: all versions
• Siemens SINAMICS G120D: all versions
• Siemens Sinamics G120P: all versions
• Siemens SINAMICS G130: all versions
• Siemens SINAMICS G150: all versions
• Siemens Sinamics G180: all versions
• Siemens Sinamics S/G Family Firmware: through 4.6
• Siemens SINAMICS S110: all versions
• Siemens Sinamics S120: all versions
• Siemens Sinamics S120Cm: all versions
• Siemens SINAMICS S150: all versions

References

• http://ics-cert.us-cert.gov/advisories/ICSA-13-338-01
• http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-742938.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-742938.pdf
• http://ics-cert.us-cert.gov/advisories/ICSA-13-338-01
• http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-742938.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-742938.pdf

Get alerted when CVE-2013-6920 or the next vulnerability affects your stack