How severe is CVE-2015-1594?

CVE-2015-1594 has a CVSS 2.0 base score of 6.9, rated medium severity.

Is CVE-2015-1594 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-1594?

CVE-2015-1594 primarily affects Siemens Starter. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-1594?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-1594 published?

CVE-2015-1594 was published on 2015-03-07 and last updated on 2026-06-17.

CVE-2015-1594

CVE-2015-1594 is a medium-severity vulnerability in Siemens Starter with a CVSS 2.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 6.9)
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Siemens Starter
Published: 2015-03-07
Last modified: 2026-06-17

Description

Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to gain privileges via a Trojan horse application file.

Frequently asked questions

What is CVE-2015-1594?: Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to gain privileges via a Trojan horse application file.
How severe is CVE-2015-1594?: CVE-2015-1594 has a CVSS 2.0 base score of 6.9, rated medium severity.
Is CVE-2015-1594 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-1594?: CVE-2015-1594 primarily affects Siemens Starter. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-1594?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2015-1594 published?: CVE-2015-1594 was published on 2015-03-07 and last updated on 2026-06-17.

References

Affected products (9)

cpe:2.3:a:siemens:starter:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_prosave:13.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:simotion_scout:*:sp1:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_cfc:*:sp4:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_cfc:8.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_step_7:*:sp1:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_step_7:5.5:sp2:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_step_7:5.5:sp3:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_step_7:5.5:sp4:*:*:*:*:*:*