What is CVE-2020-15791?
A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 CPU family (incl. SIPLUS variants) (All versions), SIMATIC WinAC RTX (F) 2010 (All versions), SINUMERIK 840D sl (All versions). The authentication protocol between a client and a PLC via port 102/tcp (ISO-TSAP) insufficiently protects the transmitted password. This could allow an attacker that is able to intercept the network traffic to obtain valid PLC credentials.
The record classifies CVE-2020-15791 under weakness class CWE-522. Its CVSS v3 base vector states that the flaw is reachable from an adjacent network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality. 28 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 2241 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 6.5 — MEDIUM
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS (FIRST)
- 0.7% probability of exploitation in the next 30 days, higher than 52.4% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 7.3/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2020-09-09, last modified 2026-06-02
Is CVE-2020-15791 being exploited?
Weaponised exploit code for CVE-2020-15791 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 26 in the Threadlinqs vulnerability feed.
- trickest/cve (trickest)
Affected products and versions
- Siemens: Simatic S7-300 Cpu 312 Firmware, Simatic S7-300 Cpu 312, Simatic S7-300 Cpu 314 Firmware, Simatic S7-300 Cpu 314, Simatic S7-300 Cpu 315-2 Dp Firmware, Simatic S7-300 Cpu 315-2 Dp, Simatic S7-300 Cpu 315-2 Pn Firmware, Simatic S7-300 Cpu 315-2 Pn, Simatic S7-300 Cpu 317-2 Pn Firmware, Simatic S7-300 Cpu 317-2 Pn, Simatic S7-300 Cpu 317-2 Dp Firmware, Simatic S7-300 Cpu 317-2 Dp, Simatic S7-300 Cpu 315f-2 Dp Firmware, Simatic S7-300 Cpu 315f-2 Dp, Simatic S7-300 Cpu 315f-2 Pn Firmware, Simatic S7-300 Cpu 315f-2 Pn, Simatic S7-300 Cpu 317f-2 Pn Firmware, Simatic S7-300 Cpu 317f-2 Pn, Simatic S7-300 Cpu 317f-2 Dp Firmware, Simatic S7-300 Cpu 317f-2 Dp, Simatic S7-400 Cpu 412 Firmware, Simatic S7-400 Cpu 412, Simatic S7-400 Cpu 414 Firmware, Simatic S7-400 Cpu 414, Simatic S7-400 Cpu 416 Firmware
Showing 25 of 28 recorded product entries.
How to fix CVE-2020-15791
The record marks a vendor fix as available for CVE-2020-15791. Patch reference: https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf. Vendor advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2020-15791
1 tracked threat in the Threadlinqs corpus references CVE-2020-15791, either in the campaign’s CVE list or as an indicator on the campaign record.
- AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure — CRITICAL · 2026-08-19
Sources
Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on .