Skip to content
Fencer Intel
medium 6.8

CVE-2015-2823 json

Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal)…

published 11y ago modified 4mo ago also EUVD-2015-2911

cvss
6.8
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC WinCC Runtime Professional before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal), SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal), SIMATIC HMI Multi Panels (WinCC TIA Portal), and SIMATIC WinCC 7.x before 7.3 Upd4 allow remote attackers to complete authentication by leveraging knowledge of a password hash without knowledge of the associated password.

Patch / fix

Is CVE-2015-2823 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-15-099-01E updated cvss 6.8

Siemens SIMATIC HMI Devices Vulnerabilities (Update E)

  • Siemens SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal) V12 <WinCC_TIA_Portal_V12_SP1_Upd5 Siemens SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal) V13 <WinCC_TIA_Portal_V13_SP1_Upd4 Siemens SIMATIC HMI Basic Panels 2nd Generation V13 <WinCC_TIA_Portal_V13_SP1_Upd2 Siemens SIMATIC HMI Comfort Panels V12 <WinCC_TIA_Portal_V12_SP1_Upd5 Siemens SIMATIC HMI Comfort Panels V13 <WinCC_TIA_Portal_V13_SP1_Upd2 Siemens SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal) V12 <WinCC_TIA_Portal_V12_SP1_Upd5
    +11 more products
    Siemens SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal) V13 <WinCC_TIA_Portal_V13_SP1_Upd4 Siemens SIMATIC HMI Multi Panels (WinCC TIA Portal) V12 <WinCC_TIA_Portal_V12_SP1_Upd5 Siemens SIMATIC HMI Multi Panels (WinCC TIA Portal) V13 <WinCC_TIA_Portal_V13_SP1_Upd4 Siemens SIMATIC NET PC-Software V12 <V12_SP2_HF3 Siemens SIMATIC NET PC-Software V13 <V13_HF1 Siemens SIMATIC PCS 7 <V8.1_SP1 Siemens SIMATIC WinCC Runtime Advanced V12 <WinCC_Runtime_Advanced_V12_SP1_Upd5 Siemens SIMATIC WinCC Runtime Advanced V13 <WinCC_Runtime_Advanced_V13_SP1_Upd2 Siemens SIMATIC WinCC Runtime Professional V13 <WinCC_TIA_Portal_V13_SP1_Upd2 Siemens SIMATIC WinCC V7.2 <V7.2_Upd11 Siemens SIMATIC WinCC V7.3 <V7.3_Upd4
    affected: mitigation “SIMATIC HMI Basic Panels 2nd Generation: Update to WinCC (TIA Portal) V13 SP1 Upd2: (https://support.industry.siemens.com/cs/ww/en/view/109311724)” support.industry.siemens.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.13% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.