Skip to content
Fencer Intel
critical 9.3

CVE-2022-38465 json

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP…

published 4y ago modified 4mo ago also EUVD-2022-41048

cvss
9.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits
0
none known

Summary

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication.

This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication.

Patch / fix

  • siemens simatic_s7-1500_software_controller 21.9
  • siemens simatic_et_200_sp_open_controller_cpu_1515sp_pc2_firmware 21.9
  • siemens simatic_drive_controller_cpu_1504d_tf_firmware 2.9.2
  • siemens simatic_drive_controller_cpu_1507d_tf_firmware 2.9.2
  • siemens simatic_s7-1200_cpu_12_1211c_firmware 4.5.0
  • siemens simatic_s7-1200_cpu_12_1212c_firmware 4.5.0
  • siemens simatic_s7-1200_cpu_12_1212fc_firmware 4.5.0
  • siemens simatic_s7-1200_cpu_12_1214fc_firmware 4.5.0
  • siemens simatic_s7-1200_cpu_12_1214c_firmware 4.5.0
  • siemens simatic_s7-1200_cpu_12_1215fc_firmware 4.5.0
  • siemens simatic_s7-1200_cpu_12_1215c_firmware 4.5.0
  • siemens simatic_s7-1200_cpu_12_1217c_firmware 4.5.0
  • siemens simatic_s7-1500_cpu_1510sp-1_firmware 2.9.2
  • siemens simatic_s7-1500_cpu_1510sp_firmware 2.9.2
  • siemens simatic_s7-1500_cpu_1511-1_firmware 2.9.2
  • siemens simatic_s7-1500_cpu_151511c-1_firmware 2.9.2
  • siemens simatic_s7-1500_cpu_151511f-1_firmware 2.9.2
  • siemens simatic_s7-1500_cpu_1511t-1_firmware 2.9.2
  • siemens simatic_s7-1500_cpu_1511tf-1_firmware 2.9.2
  • siemens simatic_s7-1500_cpu_1512c-1_firmware 2.9.2

Is CVE-2022-38465 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-314-04 updated cvss 9.3

Siemens SINUMERIK ONE and SINUMERIK MC

  • Siemens SINUMERIK MC <V6.21 Siemens SINUMERIK ONE <V6.21
    affected: fixed in V6.21, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-286-04 updated cvss 9.3

Siemens SIMATIC S7-1200 and S7-1500 CPU Families

  • Siemens SIMATIC Drive Controller family <V2.9.2
    affected: fixed in V2.9.2, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
    affected: mitigation, no fix planned
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) <V21.9
    affected: fixed in V21.9, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants) <V4.5.0
    affected: fixed in V4.5.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) <V2.9.2
    affected: fixed in V2.9.2, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 Software Controller <V21.9
    affected: fixed in V21.9, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-PLCSIM Advanced <V4.0
    affected: fixed in V4.0, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA 3.1 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Siemens SIMATIC Drive Controller family
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
  • Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
  • Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
  • Siemens SIMATIC S7-1500 Software Controller
  • Siemens SIMATIC S7-PLCSIM Advanced
  • Siemens SINUMERIK MC
  • Siemens SINUMERIK ONE

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.