Security readout for executives and security teams
Plain-English summary
This issue affects older Siemens PLC and CNC-related products where PLC login traffic on TCP/102 does not adequately protect passwords. An attacker who can observe that network traffic could recover valid PLC credentials. The main business concern is unauthorized future access to industrial controllers, not direct disruption from this CVE alone.
Executive priority
Prioritize review where affected Siemens PLCs support production, safety-adjacent, or CNC operations and where network segmentation is weak. This is not rated critical, but stolen PLC credentials can create significant operational risk if attackers gain OT network visibility.
Technical view
CVE-2020-15791 is CWE-522 in Siemens SIMATIC S7-300, S7-400, WinAC RTX (F) 2010, and SINUMERIK 840D sl, all versions. The client-to-PLC authentication protocol over ISO-TSAP TCP/102 insufficiently protects transmitted passwords. CVSS 3.1 is 6.5 with adjacent-network attack vector and high confidentiality impact.
Likely exposure
Exposure is most likely in OT environments using the listed Siemens controllers or CNC platform where engineering or management traffic to TCP/102 can be intercepted on adjacent network segments. Internet exposure is not stated in the sources and should not be assumed.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. Exploitation requires the attacker to intercept client-to-PLC traffic, so network position is the key prerequisite. The outcome is credential disclosure, which may enable later unauthorized PLC access depending on configuration and privileges.
Researcher notes
Evidence supports credential exposure via insufficient password protection during authentication over TCP/102. The provided data does not include exploit maturity, patch details, or confirmed exploitation. Treat vendor advisory SSA-381684 as the authoritative source for remediation specifics.
Mitigation direction
- Review Siemens SSA-381684 for product-specific remediation or compensating controls.
- Restrict TCP/102 access to approved engineering and management systems where feasible.
- Keep PLC authentication traffic on trusted, segmented OT network paths.
- Investigate and rotate PLC credentials if interception is suspected.
- Align any controller changes with OT change-control and vendor guidance.
Validation and detection
- Inventory Siemens assets matching the affected product list and all-version scope.
- Identify where TCP/102 is reachable between clients and PLCs.
- Review network paths where PLC authentication traffic could be observed.
- Check logs and monitoring for unexpected access to PLC engineering services.
- Confirm remediation status against Siemens SSA-381684.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-522: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-15791 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N2.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdfCVE reference, siemens · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficiently Protected Credentials
Insufficiently Protected Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.