7.5

CVE-2020-25241

A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). The underlying TCP stack of the affected products does not correctly validate the sequence number for incoming TCP RST packages. An attacker could exploit this to terminate arbitrary TCP sessions.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SiemensSimatic Mv440 Sr Firmware Version < 7.0.6
   SiemensSimatic Mv440 Sr Version-
SiemensSimatic Mv440 Hr Firmware Version < 7.0.6
   SiemensSimatic Mv440 Hr Version-
SiemensSimatic Mv440 Ur Firmware Version < 7.0.6
   SiemensSimatic Mv440 Ur Version-
SiemensSimatic Mv420 Sr-b Firmware Version < 7.0.6
   SiemensSimatic Mv420 Sr-b Version-
SiemensSimatic Mv420 Sr-p Firmware Version < 7.0.6
   SiemensSimatic Mv420 Sr-p Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.57
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input

The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.

CWE-129 Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.