Detections
Analytics

Siemens SIMATIC HMI Panels and TIA Portal <= v15.1 Update 1 Insufficiently Protected Credentials (ICSA-19-134-09)

high Nessus Network Monitor Plugin ID 720275

Synopsis

The use of insufficiently protected credentials has been identified in SIMATIC HMI Panels &lt; v15.1 Update 1, HMI Classic Devices (all versions), and TIA Portal &lt;= v15.1 Update 1.

Description

An attacker with network access to affected devices could potentially obtain a TLS session key. If the attacker is able to observe TLS traffic between a legitimate user and the device, then the attacker could decrypt the TLS traffic. The security vulnerability could be exploited by an attacker who has network access to the web interface of the device and who is able to observe TLS traffic between legitimate users and the web interface of the affected device.

Solution

Perform vendor recommended mitigations and apply available vendor upgrades.

See Also

https://www.us-cert.gov/ics/advisories/ICSA-19-134-09

Plugin Details

Severity: High

ID: 720275

Family: SCADA

Published: 7/31/2019

Updated: 9/30/2019

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 5/14/2019

Vulnerability Publication Date: 5/14/2019

Reference Information

CVE: CVE-2019-6576

BID: 108412