Siemens SIMATIC Sm@rtClient Android App
The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a man-in-the-middle attack. This vulnerability affects only SIMATIC WinCC Sm@rtClient for Android.CVE-2017-6870 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). An attacker with physical access to an unlocked mobile device that has the affected app running could bypass the app 's authentication mechanism under certain conditions. SIMATIC WinCC Sm@rtClient Lite for Android is only affected by this vulnerability.CVE-2017-6871 has been assigned to this vulnerability. A CVSS v3 base score of 4.6 has been calculated; the CVSS vector string is (AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).