CVE-2023-37482: Siemens SIMATIC Drive Controller CPU 1504d Tf

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.

Affected products

• Siemens SIMATIC Drive Controller CPU 1504d Tf: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Drive Controller CPU 1507d Tf: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp CPU 1510sp-1 Pn: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp CPU 1510sp F-1 Pn: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp CPU 1512sp-1 Pn: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp CPU 1512sp F-1 Pn: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp CPU 1514sp-2 Pn: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp CPU 1514sp F-2 Pn: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp CPU 1514spt-2 Pn: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp CPU 1514spt F-2 Pn: from V3.1.0, before V3.1.2 (fixed in V3.1.2)
• Siemens SIMATIC Et 200sp Open Controller CPU 1515sp PC2 Incl. Siplus Variants: from V30.1.0, before V31.1.4 (fixed in V31.1.4)
• Siemens SIMATIC s7-1200 CPU 1211c Ac/dc/rly: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1211c Dc/dc/dc: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1211c Dc/dc/rly: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1212c Ac/dc/rly: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1212c Dc/dc/dc: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1212c Dc/dc/rly: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1212fc Dc/dc/dc: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1212fc Dc/dc/rly: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1214c Ac/dc/rly: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1214c Dc/dc/dc: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1214c Dc/dc/rly: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1214fc Dc/dc/dc: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1214fc Dc/dc/rly: before V4.7 (fixed in V4.7)
• Siemens SIMATIC s7-1200 CPU 1215c Ac/dc/rly: before V4.7 (fixed in V4.7)
• and 67 more

Published 2025-02-11. Last modified 2026-06-17.