CVE-2019-6572

published 2019-05-14

CVE-2019-6572: A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All…

Priority P2 60 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The affected device offered SNMP read and write capacities with a publicly know hardcoded community string. The security vulnerability could be exploited by an attacker with network access to the affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
siemens	simatic_hmi_comfort_outdoor_panels_firmware	< 15.1	15.1
siemens	simatic_hmi_comfort_panels_firmware	< 15.1	15.1
siemens	simatic_hmi_ktp_mobile_panels_ktp400f_firmware	< 15.1	15.1
siemens	simatic_hmi_ktp_mobile_panels_ktp700_firmware	< 15.1	15.1
siemens	simatic_hmi_ktp_mobile_panels_ktp700f_firmware	< 15.1	15.1
siemens	simatic_hmi_ktp_mobile_panels_ktp900_firmware	< 15.1	15.1
siemens	simatic_hmi_ktp_mobile_panels_ktp900f_firmware	< 15.1	15.1
siemens	simatic_wincc	< 15.1	15.1
siemens	simatic_wincc_runtime	< 15.1	15.1
siemens_ag	simatic_hmi_classic_devices	—	—
siemens_ag	simatic_hmi_comfort_outdoor_panels_7_15	—	—
siemens_ag	simatic_hmi_comfort_panels_4_22	—	—
siemens_ag	simatic_wincc	—	—
siemens_ag	simatic_wincc_runtime_advanced	—	—
siemens_ag	simatic_wincc_runtime_professional	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 161/UDP↗

• → CVE-2019-6572 exploits a hardcoded SNMP community string on affected Siemens SIMATIC HMI/WinCC devices; monitor for unauthorized SNMP read/write activity (GET/SET requests) on UDP port 161 originating from untrusted hosts targeting these devices. ↗
• → Alert on any SNMP SET (write) requests to Siemens SIMATIC HMI/WinCC devices from hosts not explicitly whitelisted, as the hardcoded community string is publicly known and requires no credentials or user interaction. ↗
• → Downstream exploitation of CVE-2019-6572 (SNMP write via hardcoded community string) can enable XSS via device configuration modification; correlate SNMP SET activity with subsequent anomalous web interface behavior on the same device. ↗

• · The hardcoded SNMP community string is described as 'publicly known' but is not explicitly printed in the available advisories; defenders should consult Siemens SSA-307392 directly for the exact string value to use in detection signatures. ↗
• · SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) have NO fix available ('all versions' are affected); detection and network segmentation controls are the only mitigations for this device class. ↗

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200 CWE-798