CVE-2019-10926

Name of the Vulnerable Software and Affected Versions SIMATIC MV400 family versions prior to V7.0.6

Description The issue is related to a lack of encryption in the communication between the device and the user. This allows an attacker in a privileged network position to obtain data transmitted between the device and the user. The attacker must be in a position to eavesdrop on the communication between the affected device and the user, and the user must invoke a session. Successful exploitation compromises the confidentiality of the transmitted data.

Recommendations For SIMATIC MV400 family versions prior to V7.0.6, update to version V7.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the network to minimize the risk of exploitation.