Siemens SiPass Integrated Products Missing Authentication Vulnerability Allowing Unauthenticated Access to Sensitive Data

A vulnerability exists in Siemens SiPass integrated AC5102 (ACC-G2) and ACC-AP, all versions prior to V6.4.8. The vulnerability arises because affected devices expose several MQTT URLs without authentication, potentially allowing an unauthenticated remote attacker to access sensitive data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data via the exposed MQTT URLs.

Remediation

Siemens has released version V6.4.8 for both SiPass integrated AC5102 (ACC-G2) and ACC-AP. Users are advised to update to this version. For general security, it is recommended to protect network access to affected products with appropriate measures and to follow recommended security practices to maintain a secure IT environment.