Filtered by vendor Siemens Subscriptions
Filtered by product Simatic Mv440 Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-27632 1 Siemens 4 Simatic Mv420, Simatic Mv420 Firmware, Simatic Mv440 and 1 more 2024-11-21 7.5 High
In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments. An attacker could predict and hijack TCP sessions.
CVE-2019-13946 1 Siemens 101 Dk Standard Ethernet Controller, Ek-ertec 200, Ek-ertec 200 Firmware and 98 more 2024-11-21 7.5 High
Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.
CVE-2019-10926 1 Siemens 4 Simatic Mv420, Simatic Mv420 Firmware, Simatic Mv440 and 1 more 2024-11-21 N/A
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). Communication with the device is not encrypted. Data transmitted between the device and the user can be obtained by an attacker in a privileged network position. The security vulnerability can be exploited by an attacker in a privileged network position which allows eavesdropping the communication between the affected device and the user. The user must invoke a session. Successful exploitation of the vulnerability compromises confidentiality of the data transmitted.
CVE-2019-10925 1 Siemens 4 Simatic Mv420, Simatic Mv420 Firmware, Simatic Mv440 and 1 more 2024-11-21 7.1 High
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially crafted requests to the integrated webserver. The security vulnerability can be exploited by an attacker with network access to the device. Valid user credentials, but no user interaction are required. Successful exploitation compromises integrity and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.