CVE-2020-7592

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC HMI KTP700F Mobile Arctic (All versions), SIMATIC HMI Mobile Panels 2nd Generation (All versions), SIMATIC WinCC Runtime Advanced (All versions). Unencrypted communication between the configuration software and the respective device could allow an attacker to capture potential plain text communication and have access to sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Siemens AG	SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants)	All versions
Siemens AG	SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)	All versions
Siemens AG	SIMATIC HMI Comfort Panels (incl. SIPLUS variants)	All versions
Siemens AG	SIMATIC HMI KTP700F Mobile Arctic	All versions
Siemens AG	SIMATIC HMI Mobile Panels 2nd Generation	All versions
Siemens AG	SIMATIC WinCC Runtime Advanced	All versions

References

https://cert-portal.siemens.com/productcert/pdf/ssa-364335.pdfVendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-196-04Third Party Advisory, US Government Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-364335.pdfVendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-196-04Third Party Advisory, US Government Resource

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-75939.8A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.0 CVE-2020-75947.2MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by na CVE-2020-75957.5xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.CVE-2020-75968.8Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.CVE-2020-75978.8codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argum CVE-2020-75985.6minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.CVE-2020-75996.5All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin au CVE-2020-76005.3querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be control CVE-2020-76019.8gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function loca CVE-2020-76029.8node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linu CVE-2020-76039.8closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" CVE-2020-76049.8pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attack