The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the service is enabled. Telnet is disabled by default on the SINAMICS Medium Voltage Products (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-31337
• https://us-cert.cisa.gov/ics/advisories/icsa-21-131-04