CVE-2019-6572

Vulnerability

A hardcoded SNMP read/write community string is present in Siemens SIMATIC HMI Comfort Panels 4"–22" (all versions prior to V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (all versions prior to V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900, KTP900F (all versions prior to V15.1 Update 1), SIMATIC WinCC Runtime Advanced (all versions prior to V15.1 Update 1), SIMATIC WinCC Runtime Professional (all versions prior to V15.1 Update 1), SIMATIC WinCC (TIA Portal) (all versions prior to V15.1 Update 1), and SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (all versions). The community string is publicly known, enabling unauthenticated SNMP operations [1].

Exploitation

An attacker with network access to the affected device can send SNMP GET and SET requests using the hardcoded community string. No system privileges, user interaction, or prior authentication are required. The vulnerability is remotely exploitable with low skill level [1].

Impact

Successful exploitation allows the attacker to read and write device variables via SNMP, compromising both confidentiality and integrity of the affected system. The CVSS v3 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) [1].

Mitigation

Siemens has released V15.1 Update 1 to fix this vulnerability for the affected products (except HMI Classic Devices, which are end-of-life). Customers should update to the patched version. No workaround is available; Siemens recommends restricting network access to SNMP ports on affected devices as a general security practice [1].