Several Murrelektronik Devices use Default SNMP Community Names

Several Murrelektronik devices using Profinet are shipped with the default SNMP community names ('public' for read access and 'private' for write access). If these community strings remain unchanged in the field, an unauthenticated attacker with network access to the device can read its configuration and, depending on the writable OIDs, modify device settings.

An unauthenticated attacker with network access to an affected device can read sensitive configuration data via SNMP read access (loss of confidentiality). With write access to the 'private' community, the attacker can modify device parameters exposed via writable OIDs, which may disrupt device operation or alter the behaviour of connected industrial processes (loss of integrity and potential loss of availability).

No vendor fix is currently available for the majority of affected products.
A firmware update addressing vulnerability is planned for early 2027 for the Impact67 Pro (article numbers 54620, 54630) and MVK Pro (article numbers 54600, 54610) product variants.

Murrelektronik GmbH thanks the following parties for their efforts:

• CERT@VDE for coordination (see https://certvde.com )
• Lena Heim from Wenglor for reporting the vulnerability to Murrelektronik GmbH