TIA VAPT: Siemens S7 1200/1500 Project Password Vuln

[osmoscom]

Zuviel Werbung?
-> Hier kostenlos registrieren

I specialize in industrial cybersecurity, with a current research focus on the security mechanisms in Siemens TIA Portal—specifically FB/POU and project password protection. My work involves testing these features up to TIA Portal V20 and analyzing their impact on engineering workflows in OT environments.

During authorized testing on S7-1200 and S7-1500 PLCs with TIA Portal V19 , I successfully retrieved project data without original username and password. A core finding is the significant role of version compatibility in data accessibility. Additionally, this exercise reinforces that project protection settings are a critical variable, directly influencing recoverability and must be carefully considered in security research and OT risk assessments.

My hands-on experience is primarily with S7-1200 and S7-1500 PLCs, spanning programming, troubleshooting, and authorized security testing. I'm here to share insights from my research, discuss practical implications, and learn from others in the OT security community.

Looking forward to your insight!

 

[LucasMucas]

Well, with what TIA version could you extract data?
Was the project protected?
Did you inform Siemens about the issue?
Is the issue already known and fixed and therefore available as a security advisory in the Siemens CERT database?

Siemens ProductCERT and Siemens CERT

The central expert teams for immediate response to security threats and issues affecting Siemens products, solutions, services, or infrastructure.

www.siemens.com

 

[osmoscom]

Zuviel Werbung?
-> Hier kostenlos registrieren

I tested on TIA Portal V19 .
Yes Project was password protected .
Yes , I inform it.

 

[LucasMucas]

Did you do your tests with with the latest update?

SIOS

support.industry.siemens.com

 

[osmoscom]

Not yet. But i will test it soon.