PT-2019-2671 · Siemens · Simatic Mv400

Published 2019-06-11 · Updated 2021-03-15 · CVE-2019-10926

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC MV400 family versions prior to V7.0.6

Description The issue is related to a lack of encryption in the communication between the device and the user. This allows an attacker in a privileged network position to obtain data transmitted between the device and the user. The attacker must be in a position to eavesdrop on the communication between the affected device and the user, and the user must invoke a session. Successful exploitation compromises the confidentiality of the transmitted data.

Recommendations For SIMATIC MV400 family versions prior to V7.0.6, update to version V7.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the network to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

CWE-310

Related Identifiers

BDU:2019-02558

CVE-2019-10926

Affected Products

Simatic Mv400

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10926 · Security Note
• https://bdu.fstec.ru/vul/2019-02558 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdf · Vendor Advisory
• http://securityfocus.com/bid/108725 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-162-02 · Note