CVE-2019-10926

lowpriority · track · 22OT risk · elevatedEPSS 0.015 · 75 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.55% (75th) EPSS

CVSS 2.6 · low

Is it mine?

7 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-28

A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). Communication with the device is not encrypted. Data transmitted between the device and the user can be obtained by an attacker in a privileged network position. The security vulnerability can be exploited by an attacker in a privileged network position which allows eavesdropping the communication between the affected device and the user. The user must invoke a session. Successful exploitation of the vulnerability compromises confidentiality of the data transmitted.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSIMATIC MV400 familycisa_csaf_ot
Update to V7.0.6 https://support.industry.siemens.com/cs/ww/en/view/109793481/
MitigationSIMATIC MV400 familycisa_csaf_ot
By setting the DISA bit, changes to the project by logged-in users can be prevented. Please refer to the Operating Instructions for more details: https://support.industry.siemens.com/cs/ww/en/view/84553392

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.6–5.3

v2.02.6lowAV:N/AC:H/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 4.9 · impact 2.9

v3.05.3mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 1.6 · impact 3.6

v3.04.9mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.15.3mediumAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-310USCWE-310USCWE-319USCWE-319US

affected products (7)

Products and version ranges known to be affected.

Siemens SIMATIC MV400 family: All Versions < V7.0.6all versionscisa_csaf_otUS
Siemens SIMATIC MV400 family< V7.0.6cisa_csaf_otUS
Siemens SIMATIC MV400 familyAll Versions → V7.0.6enisa_euvdEU
Siemens AG SIMATIC Ident MV420all versionsfstec_bduRU
Siemens AG SIMATIC Ident MV440all versionsfstec_bduRU
siemens simatic mv420 firmwareall versionsnvdUScpe:2.3:o:siemens:simatic_mv420_firmware:*:*:*:*:*:*:*:*
siemens simatic mv440 firmwareall versionsnvdUScpe:2.3:o:siemens:simatic_mv440_firmware:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-19-162-02Siemens SIMATIC Ident MV440 Family (Update A)2019-06-11icsa · cisa_csaf_otUS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

published 2019-06-12modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan