SNMP Vulnerability in Siemens SIMATIC HMI Products
CVE-2019-6572
9.1CRITICAL
Key Information:
Summary
A vulnerability exists in various Siemens SIMATIC HMI products, allowing SNMP read and write operations through a hardcoded community string. This security issue can be exploited by attackers with network access, enabling potential risks to confidentiality and integrity without the need for system privileges or user interaction. Remediation is necessary, as the risk of exploitation exists despite the lack of known public exploits at the time of the advisory.
Affected Version(s)
SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) All versions
SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions < V15.1 Update 1
SIMATIC HMI Comfort Panels 4" - 22" All versions < V15.1 Update 1
References
CVSS V3.1
Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved