CVE-2023-37482

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-11 · updated 2026-06-17
Weakness: CWE-203

Description

The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.

Affected products

Siemens SIMATIC Drive Controller CPU 1504D TF: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC Drive Controller CPU 1507D TF: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP CPU 1514SP-2 PN: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN: from V3.1.0 before V3.1.2 — fixed in V3.1.2
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants): from V30.1.0 before V31.1.4 — fixed in V31.1.4
Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1211C DC/DC/DC: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1211C DC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1212C AC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DC: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1212C DC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DC: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1214C AC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1214C DC/DC/DC: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1214C DC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/DC: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1215C AC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1215C DC/DC/DC: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1215C DC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/DC: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/Rly: before V4.7 — fixed in V4.7
Siemens SIMATIC S7-1200 CPU 1217C DC/DC/DC: before V4.7 — fixed in V4.7

How to fix

Upgrade to a fixed version: Siemens SIMATIC Drive Controller CPU 1504D TF V3.1.2; Siemens SIMATIC Drive Controller CPU 1507D TF V3.1.2; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN V3.1.2; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN V3.1.2; Siemens SIMATIC ET 200SP CPU 1512SP-1 PN V3.1.2; Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN V3.1.2; Siemens SIMATIC ET 200SP CPU 1514SP-2 PN V3.1.2; Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN V3.1.2; Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN V3.1.2; Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN V3.1.2; Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V31.1.4; Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly V4.7. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-195895.html

Get alerted when CVE-2023-37482 or the next vulnerability affects your stack