Simatic Et 200Sp Open Controller Cpu 1515Sp Pc2 (Incl. Siplus Variants) V3 Cpus Windows Os
Approved changes feed: RSS · Atom
cpe:2.3:a:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2_(incl._siplus_variants)_v3_cpus_-_windows_os:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Siemens (4bd2a91b-02ad-5c3d-b25f-70697e0c9d7f) |
|---|---|
| Product | Simatic Et 200Sp Open Controller Cpu 1515Sp Pc2 (Incl. Siplus Variants) V3 Cpus Windows Os (88ca6674-a595-5bb4-8c40-42bf757577a8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-40943 |
vulnerable | 2026-06-08 07:25:06.366225 |
Details available
CRITICAL (9.6)
Affected devices do not properly sanitize contents of trace files.
This could allow an attacker to inject code through social engineering an authorized user, who has the function right "Read diagnostics", to import a specially crafted trace file.
The malicious trace file is insufficiently sanitized and malicious code could be executed in the clients browser session and trigger PLC operations via the webserver that the legitimate user is authorized to perform.
Published: 2026-03-10T16:07:50.385Z
Updated: 2026-05-12T08:20:49.293Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46887 |
vulnerable | 2026-06-08 06:48:10.768276 |
Details available
MEDIUM (5.3)
The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.
Published: 2024-10-08T08:40:43.510Z
Updated: 2025-10-21T14:12:27.657Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46886 |
vulnerable | 2026-06-08 06:48:10.675191 |
Details available
MEDIUM (4.7)
The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted link.
Published: 2024-10-08T08:40:41.244Z
Updated: 2025-10-14T09:15:03.919Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.