CVE-2015-1358

The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.

• CWE-310

• http://www.securityfocus.com/bid/72625
• http://www.securitytracker.com/id/1036090
• http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf
• http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdfVendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02US Government Resource
• http://www.securityfocus.com/bid/72625
• http://www.securitytracker.com/id/1036090
• http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf
• http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdfVendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02US Government Resource

Published

Feb 18, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1351Use-after-free vulnerability in the _zend_shared_memdup func…
• CVE-2015-1352The build_tablename function in pgsql.c in the PostgreSQL (a…
• CVE-2015-1353Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-1355Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a wea…
• CVE-2015-1356Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines…
• CVE-2015-1357Siemens Ruggedcom WIN51xx devices with firmware before SS4.4…
• CVE-2015-1359Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h i…
• CVE-2015-1360Skia, as used in Google Chrome before 40.0.2214.91, allows r…
• CVE-2015-1361platform/image-decoders/ImageFrame.h in Blink, as used in Go…
• CVE-2015-1362Buffer overflow in the Customize 35mm tab in Two Pilots Exif…
• CVE-2015-1363Cross-site scripting (XSS) vulnerability in Free Reprintable…
• CVE-2015-1364SQL injection vulnerability in the getProfile function in sy…