CVE-2015-1358
The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.
Key facts
- CVSS score
- 5.0 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:N/A:N- Weakness (CWE)
- CWE-310
- EPSS score
- 2.7% (86th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2015-1497)
- Published
- February 18, 2015
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2015-1497 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- siemens / wincc
References
- http://www.securityfocus.com/bid/72625
- http://www.securitytracker.com/id/1036090
- http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf(Vendor Advisory)
- https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02(US Government Resource)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain