Siemens · Simatic Wincc Flexible · CVE-2015-1358
**Name of the Vulnerable Software and Affected Versions**
Siemens SIMATIC WinCC (TIA Portal) versions prior to 13 SP1
Siemens SIMATIC WinCC flexible versions prior to 2008 SP3 Up7
**Description**
The issue concerns the remote-management module in certain Siemens products, where credentials are not properly encrypted in transit. This makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.
**Recommendations**
For Siemens SIMATIC WinCC (TIA Portal) versions prior to 13 SP1, update to version 13 SP1 or later.
For Siemens SIMATIC WinCC flexible versions prior to 2008 SP3 Up7, update to version 2008 SP3 Up7 or later.