CVE-2023-37482 Information disclosure in SIMATIC Drive Controller CPU 1504D TF
An unauthenticated attacker can determine valid usernames by analyzing login response time variations in Siemens SIMATIC devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-37482?
CVE-2023-37482 is a medium-severity vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.
Weakness: CWE-203
Which versions are affected by CVE-2023-37482?
How do I fix CVE-2023-37482?
No fix has been published for CVE-2023-37482 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-37482 being exploited?
There is no known exploitation of CVE-2023-37482 in the wild and no public exploit code.
Sources
Also known as GHSA-p6r5-883m-2c48.