CVE-2015-8214 Missing authorization in n/a

Q: Is CVE-2015-8214 being exploited?

There is no known exploitation of CVE-2015-8214 in the wild and no public exploit code.

Q: How do I fix CVE-2015-8214?

No fix has been published for CVE-2015-8214 yet. Limit exposure of the affected software until one is available.

Critical 9.7 Published 27 Nov 2015 Updated 6 Aug 2024

Unauthenticated attackers can perform administrative operations on affected Siemens communication processors if specific configuration conditions are met.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2015-8214?

CVE-2015-8214 is a critical missing authorization vulnerability in n/a, published on 27 Nov 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions < V3.0.44), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 443-1 Advanced (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-1 Standard (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-5 Basic (incl. SIPLUS variants) (All versions), SIMATIC NET CP 443-5 Extended (All versions), TIM 3V-IE / TIM 3V-IE Advanced (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 3V-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0), TIM 4R-IE (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 4R-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0). The implemented access protection level enforcement of the affected communication processors (CP) could possibly allow unauthenticated users to perform administrative operations on the CPs if network access (port 102/TCP) is available and the CPs' configuration was stored on their corresponding CPUs.

Weakness: CWE-264

Which versions are affected by CVE-2015-8214?

It affects 4 products.

Products include Siemens Simatic Cp 343-1 Firmware, Siemens Simatic Cp 443-1 Firmware, Siemens Simatic Tim 3v-Ie Firmware, Siemens Simatic Tim 4r-Ie Firmware.

How do I fix CVE-2015-8214?

No fix has been published for CVE-2015-8214 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2015-8214 being exploited?

There is no known exploitation of CVE-2015-8214 in the wild and no public exploit code.

Sources

Also known as GHSA-jc83-h8w6-gwfh.