title: ICSA-20-098-05 KUKA.Sim Pro Improper Enforcement of Message Integrity During Transmission in a Communication Channel
description: Simulation models for KUKA.Sim Pro version 3.1 are hosted by a server maintained by KUKA. When these devices request a model, the server transmits the model in plaintext.
problem types: CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
affected:
{
product: Sim Pro
vendor: KUKA
versions:
status: affected, version: 3.1
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
]
solutions: KUKA recommends upgrading KUKA.Sim Pro to Version 3.1.2 or above to mitigate this vulnerability. The update is provided for users with a licensed Version 3.1. Version 3.1 is the only affected version that is still maintained. All previous versions of KUKA.Sim Pro have been discontinued; Version 3.0 has been discontinued since the beginning of 2019.