Vulnerability Description
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially crafted requests to the integrated webserver. The security vulnerability can be exploited by an attacker with network access to the device. Valid user credentials, but no user interaction are required. Successful exploitation compromises integrity and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Simatic Mv420 Firmware | All versions |
| Siemens | Simatic Mv420 | - |
| Siemens | Simatic Mv440 Firmware | All versions |
| Siemens | Simatic Mv440 | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/108725Third Party AdvisoryVDB Entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdfMitigationVendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-19-162-02Third Party AdvisoryUS Government Resource
- http://www.securityfocus.com/bid/108725Third Party AdvisoryVDB Entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdfMitigationVendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-19-162-02Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2019-10925?
CVE-2019-10925 is a vulnerability with a CVSS score of 7.1 (HIGH). A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially crafted requests to the integrated webserv...
How severe is CVE-2019-10925?
CVE-2019-10925 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10925?
Check the references section above for vendor advisories and patch information. Affected products include: Siemens Simatic Mv420 Firmware, Siemens Simatic Mv420, Siemens Simatic Mv440 Firmware, Siemens Simatic Mv440.