Medium severity · published Jul 14, 2020
CVE-2020-7592
A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC HMI KTP700F Mobile Arctic (All versions), SIMATIC HMI Mobile Panels 2nd Generation (All versions), SIMATIC WinCC Runtime Advanced (All versions). Unencrypted communication between the configuration software and the respective device could allow an attacker to capture potential plain text communication and have access to sensitive information.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Simatic Hmi Basic Panels 1st Generation · Siemens
All versions, or not specified · source: NVD
SH
Simatic Hmi Basic Panels 2nd Generation · Siemens
All versions, or not specified · source: NVD
SH
Simatic Hmi Comfort Panels Firmware · Siemens
All versions, or not specified · source: NVD
SH
Simatic Hmi Ktp700f Mobile Arctic Firmware · Siemens
All versions, or not specified · source: NVD
SH
Simatic Hmi Mobile Panels 2nd Generation Firmware · Siemens
All versions, or not specified · source: NVD
SW
Simatic Wincc Runtime Advanced · Siemens
All versions, or not specified · source: NVD