CVE-2020-15786

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions <= V16), SIMATIC HMI Mobile Panels (All versions <= V16), SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently block excessive authentication attempts. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-157879.8A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate auCVE-2020-157886.1A vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion subversion web application does not filterCVE-2020-157898.1A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cross-Site Request ForgCVE-2020-15797.8An elevation of privilege vulnerability exists when the Windows Function Discovery SSDP Provider improperly handles memory. To exploit this CVE-2020-157905.3A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). If configured in an insecure manner, the web server mighCVE-2020-157916.5A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-4CVE-2020-157924.3A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some querCVE-2020-157935.4A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header whichCVE-2020-157944.3A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to tCVE-2020-157958.1A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions <CVE-2020-157967.5A vulnerability has been identified in SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) (V20.8), SIMATIC S7-1500 Software ControllerCVE-2020-157976.8A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers
CVE-2020-15786: Critical severity, CVSS 9.8 | Vulnix