{"id":"CVE-2023-37482","aliases":["EUVD-2023-41369","GHSA-p6r5-883m-2c48"],"status":"published","title":"The login functionality of the web server in affected devices does not normalize the response...","description":"The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0051,"percentile":0.43994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-203"],"published":"2025-02-11T10:26:27Z","modified":"2026-06-17T06:08:18Z","products":[{"vendor":"siemens","product":"simatic drive controller cpu 1504d tf"},{"vendor":"siemens","product":"simatic drive controller cpu 1507d tf"},{"vendor":"siemens","product":"simatic et 200sp cpu 1510sp f-1 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1510sp-1 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1512sp f-1 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1512sp-1 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1514sp f-2 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1514sp-2 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1514spt f-2 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1514spt-2 pn"},{"vendor":"siemens","product":"simatic et 200sp open controller cpu 1515sp pc2 (incl. siplus variants)"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1211c ac/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1211c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1211c dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212c ac/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212c dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212fc dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212fc dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214c ac/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214c dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214fc dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214fc dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215c ac/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215c dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215fc dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215fc dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1217c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1510sp f-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1510sp-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1511-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1511c-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1511f-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1511t-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1511tf-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1512c-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1512sp f-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1512sp-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1513-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1513f-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1513pro f-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1513pro-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1513r-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1514sp f-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1514sp-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1514spt f-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1514spt-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1515-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1515f-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1515r-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1515t-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1515tf-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1516-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1516f-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1516pro f-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1516pro-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1516t-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1516tf-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1517-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1517f-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1517h-3 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1517t-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1517tf-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518hf-4 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518t-4 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518tf-4 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 software controller"},{"vendor":"siemens","product":"simatic s7-1500 software controller cpu 1507s f v3"},{"vendor":"siemens","product":"simatic s7-1500 software controller cpu 1507s v3"},{"vendor":"siemens","product":"simatic s7-1500 software controller cpu 1508s f v3"},{"vendor":"siemens","product":"simatic s7-1500 software controller cpu 1508s t v3"},{"vendor":"siemens","product":"simatic s7-1500 software controller cpu 1508s tf v3"},{"vendor":"siemens","product":"simatic s7-1500 software controller cpu 1508s v3"},{"vendor":"siemens","product":"simatic s7-1500 software controller linux v3"},{"vendor":"siemens","product":"simatic s7-plcsim advanced"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212 ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212 dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212c dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212c dc/dc/dc rail"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214 ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214 dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214 dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214c dc/dc/dc rail"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214fc dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214fc dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215 ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215 dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215 dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215c dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215fc dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1517h-3 pn"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518f-4 pn/dp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518hf-4 pn"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-195895.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37482"},{"url":"https://github.com/advisories/GHSA-p6r5-883m-2c48"}],"sources":{"cve":[{"id":"CVE-2023-37482","description":"The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.","status":"published","published":"2025-02-11T10:26:27.72Z","modified":"2025-04-08T08:19:41.567Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:35:16.126506Z"}],"euvd":[{"id":"EUVD-2023-41369","description":"The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.","status":"published","published":"2025-02-11T10:26:27Z","modified":"2025-04-08T08:19:41Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:40.600826Z"}],"ghsa":[{"id":"GHSA-p6r5-883m-2c48","title":"The login functionality of the web server in affected devices does not normalize the response...","description":"The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.","status":"published","published":"2025-02-11T12:30:54Z","modified":"2025-02-11T12:31:02Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:59:52.638126Z"}],"nvd":[{"id":"CVE-2023-37482","description":"The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.","status":"published","published":"2025-02-11T11:15:11.427Z","modified":"2026-06-17T06:08:18.503Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:09:20.080574Z"}]}}