CVE-2015-1358

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-02-18 · updated 2026-06-17
Weakness: CWE-310

Description

The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.

Affected products

Siemens SIMATIC WinCC: 13.0

References

http://www.securityfocus.com/bid/72625
http://www.securitytracker.com/id/1036090
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf
https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02
http://www.securityfocus.com/bid/72625
http://www.securitytracker.com/id/1036090
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf
https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02

Get alerted when CVE-2015-1358 or the next vulnerability affects your stack