Skip to content
Fencer Intel
medium 5.3

CVE-2020-28397 json

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP…

published 5y ago modified 4mo ago also EUVD-2020-20856

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7 PLCSIM Advanced (All versions > V2 < V4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Version V4.4), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions > V2.5 < V2.9.2), SIMATIC S7-1500 Software Controller (All versions > V2.5 < V21.9), TIM 1531 IRC (incl. SIPLUS NET variants) (Version V2.1). Due to an incorrect authorization check in the affected component, an attacker could extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once.

Patch / fix

  • siemens simatic_s7-1500_software_controller 21.9
  • siemens cpu_1504d_tf_firmware 2.9.2
  • siemens cpu_1507d_tf_firmware 2.9.2
  • siemens cpu_1515sp_pc2_tf_firmware 21.9
  • siemens simatic_s7_plcsim_advanced_firmware 4.0
  • siemens siplus_cpu_1510sp_f-1pn_firmware 2.9.2
  • siemens siplus_cpu_1511-1_pn_firmware 2.9.2
  • siemens siplus_cpu_1511f-1_pn_firmware 2.9.2
  • siemens siplus_cpu_1512sp-1_pn_firmware 2.9.2
  • siemens siplus_cpu_1512sp_f-1pn_firmware 2.9.2
  • siemens siplus_cpu_1513-1_pn_firmware 2.9.2
  • siemens siplus_cpu_1513f-1_pn_firmware 2.9.2
  • siemens siplus_cpu_1516-3_pn/dp_firmware 2.9.2
  • siemens siplus_cpu-1516f-3_pn/dp_firmware 2.9.2
  • siemens siplus_cpu_1518-4_pn/dp_firmware 2.9.2
  • siemens siplus_cpu_1518f-4_pn/dp_firmware 2.9.2
  • siemens cpu_1510sp-1pn_firmware 2.9.2
  • siemens cpu1510sp_f-1_firmware 2.9.2
  • siemens cpu_1511-1pn_firmware 2.9.2
  • siemens cpu_1511c-1_pn_firmware 2.9.2

Is CVE-2020-28397 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-257-23 updated cvss 5.3

Siemens SIMATIC and TIM

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Siemens SIMATIC Drive Controller family
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
  • Siemens SIMATIC S7 PLCSIM Advanced
  • Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
  • Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
  • Siemens SIMATIC S7-1500 Software Controller
  • Siemens TIM 1531 IRC (incl. SIPLUS NET variants)

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.