Medium severity · published Feb 11, 2025
CVE-2023-37482
The login functionality of the web server in affected devices does not normalize the response times of login attempts
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
SIMATIC Drive Controller CPU 1504D TF · Siemens
V3.1.0 before V3.1.2 · source: vendor
SD
SIMATIC Drive Controller CPU 1507D TF · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1510SP F-1 PN · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1510SP-1 PN · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1512SP F-1 PN · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1512SP-1 PN · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SP F-2 PN · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SP-2 PN · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SPT F-2 PN · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SPT-2 PN · Siemens
V3.1.0 before V3.1.2 · source: vendor
SE
SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) · Siemens
V30.1.0 before V31.1.4 · source: vendor
SS
SIMATIC S7-1200 CPU 1211C AC/DC/Rly · Siemens
before V4.7 · source: vendor
Affected product
SD
SIMATIC Drive Controller CPU 1504D TF
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37482
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37482
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-195895.html
More from SIMATIC Drive Controller CPU 1504D TF
9.6
CVE-2026-63354
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page
9.6
CVE-2026-63353
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page
9.6
CVE-2026-63350
Affected devices do not properly restrict executable content contained in imported trace files
9.6
CVE-2025-40943
Affected devices do not properly sanitize contents of trace files
9.1
CVE-2026-25787
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface