CVE-2023-37482

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

VendorProductVersions
SiemensSIMATIC Drive Controller CPU 1504D TF>= V3.1.0, < V3.1.2
SiemensSIMATIC Drive Controller CPU 1507D TF>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP CPU 1510SP F-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP CPU 1510SP-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP CPU 1512SP F-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP CPU 1512SP-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP CPU 1514SP F-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP CPU 1514SP-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP CPU 1514SPT F-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP CPU 1514SPT-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)>= V30.1.0, < V31.1.4
SiemensSIMATIC S7-1200 CPU 1211C AC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1211C DC/DC/DC< V4.7
SiemensSIMATIC S7-1200 CPU 1211C DC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1212C AC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1212C DC/DC/DC< V4.7
SiemensSIMATIC S7-1200 CPU 1212C DC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1212FC DC/DC/DC< V4.7
SiemensSIMATIC S7-1200 CPU 1212FC DC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1214C AC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1214C DC/DC/DC< V4.7
SiemensSIMATIC S7-1200 CPU 1214C DC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1214FC DC/DC/DC< V4.7
SiemensSIMATIC S7-1200 CPU 1214FC DC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1215C AC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1215C DC/DC/DC< V4.7
SiemensSIMATIC S7-1200 CPU 1215C DC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1215FC DC/DC/DC< V4.7
SiemensSIMATIC S7-1200 CPU 1215FC DC/DC/Rly< V4.7
SiemensSIMATIC S7-1200 CPU 1217C DC/DC/DC< V4.7
SiemensSIMATIC S7-1500 CPU 1511-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1511C-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1511F-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1511T-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1511TF-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1512C-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1513-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1513F-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1513pro F-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1513pro-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1513R-1 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1515-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1515F-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1515R-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1515T-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1515TF-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1516-3 PN/DP>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1516F-3 PN/DP>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1516pro F-2 PN>= V3.1.0, < V3.1.2
SiemensSIMATIC S7-1500 CPU 1516pro-2 PN>= V3.1.0, < V3.1.2

References

Timeline

Published
Feb 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-374839.8SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries againstCVE-2023-374845.3SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during logiCVE-2023-374867.5Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access iCVE-2023-374875.3SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unCVE-2023-374886.1In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently CVE-2023-374895.3Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauCVE-2023-37495.5A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.CVE-2023-374909.0SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file creaCVE-2023-374918.8The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.2CVE-2023-374926.5SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740CVE-2023-374955.9Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in tCVE-2023-374965.4HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser t
CVE-2023-37482: Medium severity, CVSS 5.3 | Vulnix