CVE-2020-27632
High
Description
In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments. An attacker could predict and hijack TCP sessions.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSiemens Simatic Mv420 Firmware
PublishedMar 10, 2021
First seenMar 10, 2021
How to fix
Update
- siemens simatic_mv420_firmware7.0.6 or later
- siemens simatic_mv440_firmware7.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens simatic_mv420_firmware | v < 7.0.6 | 7.0.6 |
| siemens simatic_mv440_firmware | v < 7.0.6 | 7.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.