Skip to content
OpenAdvisories
Critical SSA-763427 1 CVE

SSA-763427: Authentication Bypass Vulnerability in SIMATIC CP and TIM Devices

Published Nov 27, 2015 · Updated Jul 8, 2025 · Revision 7

Vendor: Siemens Product: SIMATIC CP 342-5 (6GK7342-5DA02-0XE0) Product: SIMATIC CP 342-5 (6GK7342-5DA03-0XE0) Product: SIMATIC CP 342-5 FO (6GK7342-5DF00-0XE0) Product: SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) Product: SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0) Product: SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) Product: SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) Product: SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) Product: SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) Product: SIMATIC CP 443-5 Basic (6GK7443-5FX02-0XE0) Product: SIMATIC CP 443-5 Extended (6GK7443-5DX05-0XE0) Product: SIMATIC CP 443-5 Extended (6GK7443-5DX05-0XE1) Product: SIPLUS NET CP 343-1 (6AG1343-1EX30-7XE0) Product: SIPLUS NET CP 343-1 Advanced (6AG1343-1GX31-4XE0) Product: SIPLUS NET CP 343-1 Lean (6AG1343-1CX10-2XE0) Product: SIPLUS NET CP 443-1 (6AG1443-1EX30-4XE0) Product: SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) Product: SIPLUS NET CP 443-5 (6AG1443-5DX05-4XE0) Product: SIPLUS NET CP342-5 (6AG1342-5DA03-7XE0) Product: SIPLUS NET TIM 3V-IE (6AG1800-3BA00-7AA0) Product: SIPLUS NET TIM 3V-IE DNP3 (6AG1803-3BA00-7AA0) Product: SIPLUS NET TIM 4R-IE (6AG1800-4BA00-7AA0) Product: SIPLUS NET TIM 4R-IE DNP3 (6AG1803-4BA00-7AA0) Product: TIM 3V-IE (6NH7800-3BA00) Product: TIM 3V-IE Advanced (6NH7800-3CA00) Product: TIM 3V-IE DNP3 (6NH7803-3BA00-0AA0) Product: TIM 4R-IE (6NH7800-4BA00) Product: TIM 4R-IE DNP3 (6NH7803-4BA00-0AA0)

Summary

SIMATIC CP and TIM devices contain an authentication bypass vulnerability that could allow unauthenticated users to perform administrative operations under certain conditions.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

  • Unscored —
    CVE-2015-8214

    A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-…

Revision history

  1. #7

    CVE-2015-8214: Added CVSSv4.0 vector; SIMATIC CP 342-5, SIMATIC CP 443-5 Basic, SIMATIC CP 443-5 Extended: Clarified that no fix is planned and added product specific impact description and CVSS vectors; Expanded affected product families to individual products, incl. MLFB IDs

  2. #6

    Clarified product names and added SIMATIC NET CP PROFIBUS devices

  3. #5

    SIPLUS devices now explicitly mentioned in the list of affected products

  4. #4

    Added fix information for SIMATIC CP343-1 Lean / CP 343-1

  5. #3

    Added fix information for SIMATIC CP 443-1 / CP 443-1 Advanced

  6. #2

    Added fix information for SIMATIC TIM 3V-IE and TIM 4R-IE modules

  7. #1

    Publication Date

References