Security Vulnerabilities Fixed in SIMATIC Cloud Connect 7 V2.1

An attacker with administrative access to SIMATIC Cloud Connect 7 could potentially expose sensitive configuration data, modify operational settings, or cause the cloud connectivity service to become unavailable, disrupting remote monitoring and control of plant assets.

Water and electric utilities using SIMATIC Cloud Connect 7 (models CC712 and CC716) for remote SCADA system monitoring and control. Affects organizations that rely on cloud-based connectivity for plant asset management and situational awareness from remote locations.

An attacker with high-level credentials (administrative access) could exploit multiple vulnerabilities including command injection, hardcoded credentials, path traversal, insecure deserialization, information disclosure, and insecure file permissions to gain control over the Cloud Connect 7 device. This could allow modification of cloud gateway configurations or extraction of sensitive data used for connectivity to remote systems.