Skip to content
Fencer Intel
critical 9.7

CVE-2015-8214 json

A vulnerability has been identified in SIMATIC NET CP 342-5 (incl.

published 10y ago modified 4mo ago also EUVD-2015-8103

cvss
9.7
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions < V3.0.44), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 443-1 Advanced (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-1 Standard (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-5 Basic (incl. SIPLUS variants) (All versions), SIMATIC NET CP 443-5 Extended (All versions), TIM 3V-IE / TIM 3V-IE Advanced (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 3V-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0), TIM 4R-IE (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 4R-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0). The implemented access protection level enforcement of the affected communication processors (CP) could possibly allow unauthenticated users to perform administrative operations on the CPs if network access (port 102/TCP) is available and the CPs' configuration was stored on their corresponding CPUs.

Is CVE-2015-8214 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-15-335-03 updated cvss 9.8

Siemens SIMATIC Communication Processor Vulnerability (Update C)

  • Siemens SIMATIC CP 342-5 (6GK7342-5DA02-0XE0) Siemens SIMATIC CP 342-5 (6GK7342-5DA03-0XE0) Siemens SIMATIC CP 342-5 FO (6GK7342-5DF00-0XE0)
    affected: no fix planned
  • Siemens SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) < V3.1.1
    affected: fixed in V3.1.1 support.industry.siemens.com
  • Siemens SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0) < V3.0.44
    affected: fixed in V3.0.44 support.industry.siemens.com
  • Siemens SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) < V3.1.1
    affected: fixed in V3.1.1 support.industry.siemens.com
  • Siemens SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) < V3.2.9 Siemens SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) < V3.2.9 Siemens SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) < V3.2.9
    affected: fixed in V3.2.9 support.industry.siemens.com
  • Siemens SIMATIC CP 443-5 Basic (6GK7443-5FX02-0XE0) Siemens SIMATIC CP 443-5 Extended (6GK7443-5DX05-0XE0) Siemens SIMATIC CP 443-5 Extended (6GK7443-5DX05-0XE1)
    affected: no fix planned
  • Siemens SIPLUS NET CP 343-1 (6AG1343-1EX30-7XE0) < V3.1.1
    affected: fixed in V3.1.1 support.industry.siemens.com
  • Siemens SIPLUS NET CP 343-1 Advanced (6AG1343-1GX31-4XE0) < V3.0.44
    affected: fixed in V3.0.44 support.industry.siemens.com
show 11 more

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

2.09% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 9.7 AV:N/AC:L/Au:N/C:P/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.