CVEvulnerability

CVE-2020-25241

7.5 HIGH Published 2021-03-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-03-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-1285, CWE-129

Description

A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). The underlying TCP stack of the affected products does not correctly validate the sequence number for incoming TCP RST packages. An attacker could exploit this to terminate arbitrary TCP sessions.

Affected configurations

• siemens simatic mv440 sr firmware (< 7.0.6) • siemens simatic mv440 hr firmware (< 7.0.6) • siemens simatic mv440 ur firmware (< 7.0.6) • siemens simatic mv420 sr-b firmware (< 7.0.6) • siemens simatic mv420 sr-p firmware (< 7.0.6) • siemens simatic mv420 sr-b body firmware (< 7.0.6) • siemens simatic mv420 sr-p body firmware (< 7.0.6)

Related

Weakness · CWE (2)

  • CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input weakness
  • CWE-129 Improper Validation of Array Index weakness

References