Skip to content
Fencer Vulns
medium 5.3

CVE-2023-37482 json

The login functionality of the web server in affected devices does not normalize the response times of login attempts.

published 2025-02-11 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2023-41369

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.

Patch / fix

  • Siemens SIMATIC Drive Controller CPU 1504D TF V3.1.2
  • Siemens SIMATIC Drive Controller CPU 1507D TF V3.1.2
  • Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN V3.1.2
  • Siemens SIMATIC ET 200SP CPU 1510SP-1 PN V3.1.2
  • Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN V3.1.2
  • Siemens SIMATIC ET 200SP CPU 1512SP-1 PN V3.1.2
  • Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN V3.1.2
  • Siemens SIMATIC ET 200SP CPU 1514SP-2 PN V3.1.2
  • Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN V3.1.2
  • Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN V3.1.2
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V31.1.4
  • Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1211C DC/DC/DC V4.7
  • Siemens SIMATIC S7-1200 CPU 1211C DC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1212C AC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DC V4.7
  • Siemens SIMATIC S7-1200 CPU 1212C DC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DC V4.7
  • Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1214C AC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1214C DC/DC/DC V4.7
  • Siemens SIMATIC S7-1200 CPU 1214C DC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/DC V4.7
  • Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1215C AC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1215C DC/DC/DC V4.7
  • Siemens SIMATIC S7-1200 CPU 1215C DC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/DC V4.7
  • Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/Rly V4.7
  • Siemens SIMATIC S7-1200 CPU 1217C DC/DC/DC V4.7

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-044-02 updated cvss 5.3

Siemens SIMATIC

  • Siemens SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) >=V3.1.0, <V3.1.2
    affected: fixed in V3.1.2, mitigation
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) >=V30.1.0, <V31.1.4
    affected: fixed in V31.1.4, mitigation
  • Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1211C DC/DC/Rly (6ES7211-1HE40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1212C AC/DC/Rly (6ES7212-1BE40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DC (6ES7212-1AE40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1212C DC/DC/Rly (6ES7212-1HE40-0XB0) <V4.7
    +13 more products
    Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DC (6ES7212-1AF40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/Rly (6ES7212-1HF40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1214C AC/DC/Rly (6ES7214-1BG40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1214C DC/DC/Rly (6ES7214-1HG40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/DC (6ES7214-1AF40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/Rly (6ES7214-1HF40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1215C AC/DC/Rly (6ES7215-1BG40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1215C DC/DC/DC (6ES7215-1AG40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1215C DC/DC/Rly (6ES7215-1HG40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/DC (6ES7215-1AF40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/Rly (6ES7215-1HF40-0XB0) <V4.7 Siemens SIMATIC S7-1200 CPU 1217C DC/DC/DC (6ES7217-1AG40-0XB0) <V4.7
    affected: fixed in V4.7 support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DK03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0) >=V3.1.0, <V3.1.2
    +12 more products
    Siemens SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DM03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RM03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1514SP-2 PN (6ES7514-2DN03-0AB0) >=V3.1.0, <V3.1.2 Siemens SIMATIC S7-1500 CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0) >=V3.1.0, <V3.1.2
    affected: fixed in V3.1.2, mitigation

63 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Siemens SIMATIC Drive Controller CPU 1504D TF
  • Siemens SIMATIC Drive Controller CPU 1507D TF
  • Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN
  • Siemens SIMATIC ET 200SP CPU 1510SP-1 PN
  • Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN
  • Siemens SIMATIC ET 200SP CPU 1512SP-1 PN
  • Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN
  • Siemens SIMATIC ET 200SP CPU 1514SP-2 PN
  • Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN
  • Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
  • Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1211C DC/DC/DC
  • Siemens SIMATIC S7-1200 CPU 1211C DC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1212C AC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DC
  • Siemens SIMATIC S7-1200 CPU 1212C DC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DC
  • Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1214C AC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1214C DC/DC/DC
  • Siemens SIMATIC S7-1200 CPU 1214C DC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/DC
  • Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1215C AC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1215C DC/DC/DC
  • Siemens SIMATIC S7-1200 CPU 1215C DC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/DC
  • Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/Rly
  • Siemens SIMATIC S7-1200 CPU 1217C DC/DC/DC
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN
  • Siemens SIMATIC S7-1500 CPU 1511C-1 PN
  • Siemens SIMATIC S7-1500 CPU 1511F-1 PN
  • Siemens SIMATIC S7-1500 CPU 1511T-1 PN
  • Siemens SIMATIC S7-1500 CPU 1511TF-1 PN
  • Siemens SIMATIC S7-1500 CPU 1512C-1 PN
  • Siemens SIMATIC S7-1500 CPU 1513-1 PN
  • Siemens SIMATIC S7-1500 CPU 1513F-1 PN
  • Siemens SIMATIC S7-1500 CPU 1513pro F-2 PN
  • Siemens SIMATIC S7-1500 CPU 1513pro-2 PN
  • Siemens SIMATIC S7-1500 CPU 1513R-1 PN
  • Siemens SIMATIC S7-1500 CPU 1515-2 PN
  • Siemens SIMATIC S7-1500 CPU 1515F-2 PN
  • Siemens SIMATIC S7-1500 CPU 1515R-2 PN
  • Siemens SIMATIC S7-1500 CPU 1515T-2 PN
  • Siemens SIMATIC S7-1500 CPU 1515TF-2 PN
  • Siemens SIMATIC S7-1500 CPU 1516-3 PN/DP
  • Siemens SIMATIC S7-1500 CPU 1516F-3 PN/DP
  • Siemens SIMATIC S7-1500 CPU 1516pro F-2 PN
  • Siemens SIMATIC S7-1500 CPU 1516pro-2 PN

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.