What is the CVSS score of CVE-2022-38465?

CVE-2022-38465 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Simatic S7 1500 Software Controller CVE-2022-38465

HIGH

Insufficiently Protected Credentials (CWE-522)

2022-10-11 productcert@siemens.com

7.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-522 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V6 - Authentication Credential protection in transit/storage
Impact	CVSS score of 7.8 (HIGH). Attack characteristics: local attack vector, low complexity, low privileges required, no user interaction not required.
Exploit ScenarioDerived	A local attacker with access to the system could obtain user credentials due to weak protection mechanisms.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Hash passwords with strong algorithms (bcrypt, argon2), encrypt credentials in transit and at rest, never log credentials.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Insufficiently Protected Credentials (CWE-522), which allows attackers to obtain user credentials due to weak protection mechanisms. A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication. Affected products include: Siemens Simatic Et 200 Sp Open Controller Cpu 1515Sp Pc2 Firmware, Siemens Simatic Et 200 Sp Open Controller Cpu 1515Sp Pc Firmware, Siemens Simatic Drive Controller Cpu 1504D Tf Firmware, Siemens Simatic Drive Controller Cpu 1507D Tf Firmware, Siemens Simatic S7-1200 Cpu 12 1211C Firmware.

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionNVD

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication.

This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)NVD

cpe:2.3:o:siemens:simatic_et_200_sp_open_controller_cpu_1515sp_pc2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_et_200_sp_open_controller_cpu_1515sp_pc_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_drive_controller_cpu_1504d_tf_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_drive_controller_cpu_1507d_tf_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1211c_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1212c_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1212fc_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1214fc_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1214c_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1215fc_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1215c_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1217c_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_1510sp-1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_1510sp_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511-1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_151511c-1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_151511f-1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511t-1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511tf-1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_1512c-1_firmware:*:*:*:*:*:*:*:*

+ 25 more

More in Simatic S7 1500 Software Controller

View all

CVE-2020-15782 CRITICAL Act Now

9.8 May 28

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Co

CVE-2019-6575 HIGH This Week

7.5 Apr 17

A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515

CVE-2019-10943 HIGH This Week

7.5 Aug 13

A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller

CVE-2019-6568 HIGH This Week

7.5 Apr 17

The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. Rated hig

CVE-2017-2681 HIGH This Week

7.1 May 11

Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a d

CVE-2020-7580 MEDIUM This Month

6.7 Jun 10

A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All

CVE-2022-30694 MEDIUM This Month

6.5 Nov 08

The login endpoint /FormLogin in affected web services does not apply proper origin checking. Rated medium severity (CVS

Same weakness CWE-522 – Insufficiently Protected Credentials

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2021-30116 CRITICAL POC

9.8

CVE-2024-44000 CRITICAL POC

9.8

CVE-2023-6421 HIGH POC

7.5

CVE-2017-8225 CRITICAL POC

9.8

CVE-2025-25570 CRITICAL POC

9.8

CVE-2017-17106 CRITICAL POC

9.8

CVE-2017-8837 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

References

Advisories & patches

ADVISORY https://cert-portal.siemens.com/productcert/pdf/ssa-568427.pdf REF https://cert-portal.siemens.com/productcert/pdf/ssa-568428.pdf

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back