CVE Feed

    Dashboard / CVE / CVE-2015-1358

    CVE-2015-1358

    The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.

    Published:Feb 18, 2015
    Last Modified:Apr 12, 2025
    EPS:Feb 18, 2015
    EPSS Score:0.00795
    CVSS Score:5

    Affected Products

    Vendor
    Siemens
    Product
    Wincc

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2023-30897 (CVSS 7.8) — A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to…
    CVE-2017-12069 (CVSS 8.2) — An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Dis…
    CVE-2015-2822 (CVSS 4.3) — Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced be…
    CVE-2015-2823 (CVSS 6.8) — Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Pan…
    CVE-2014-4686 (CVSS 6.8) — The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products…
    CVE-2014-4682 (CVSS 5) — The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote…
    CVE-2014-4685 (CVSS 4.6) — Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by…
    CVE-2014-4683 (CVSS 4.9) — The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote…
    CVE-2014-4684 (CVSS 6) — The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote aut…
    CVE-2013-4911 (CVSS 6.8) — Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High