PT-2019-2670 · Siemens · Simatic Mv400

Published 2019-06-11 · Updated 2021-03-15 · CVE-2019-10925

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions SIMATIC MV400 family versions prior to V7.0.6

Description A vulnerability has been identified that allows an authenticated attacker to escalate privileges by sending specially crafted requests to the integrated webserver. The issue can be exploited by an attacker with network access to the device, requiring valid user credentials but no user interaction. Successful exploitation compromises the integrity and availability of the device. At the time of advisory publication, no public exploitation of this security issue was known.

Recommendations For SIMATIC MV400 family versions prior to V7.0.6, update to version V7.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the integrated webserver to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-264

CWE-284

Related Identifiers

BDU:2019-02557

CVE-2019-10925

Affected Products

Simatic Mv400

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10925 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02557 · Security Note
• http://securityfocus.com/bid/108725 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-162-02 · Note