CVE-2015-1356 describes a privilege escalation vulnerability in Siemens SIMATIC STEP 7 (TIA Portal) before version 13 SP1. The software fails to protect the integrity of project-file fields used for privilege determination, allowing remote attackers to manipulate these files and establish arbitrary authorization data. This vulnerability has a CVSS score of 4.4 (medium severity) with an attack vector of local access, medium attack complexity, and potential for partial impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB, despite some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 13.0CPE matchmatch criteria | cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:M/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.