Skip to content
OpenAdvisories
Medium VDE-2026-062 1 CVE

Several Murrelektronik Devices use Default SNMP Community Names

Published Jul 14, 2026 · Updated Jul 14, 2026

Vendor: Murrelektronik Product: Cube20 BN-PNIO DI8 Product: Cube20S Profinet IO Bus node Product: Cube67+ BN-PNIO Product: Impact67 PN DI16 Product: IMPACT67 PN DI16 M12L 4P Product: IMPACT67 PN DI16 M12L 5P Product: IMPACT67 PN DI8 DO8 M12L 4P Product: IMPACT67 PN DI8 DO8 M12L 5P Product: Impact67 PN DI8 DO8/2 Product: Impact67 PN DIO12 DIO4/IOL4 M12L 4P Product: Impact67 PN DIO12 DIO4/IOL4 M12L 5P Product: Impact67 PN DIO12 IOL4 IRT Product: Impact67 PN DIO14 DIO2/IOL2 M12L 4P Product: Impact67 PN DIO14 DIO2/IOL2 M12L 5P Product: Impact67 PN DIO14 IOL2 IRT Product: Impact67 PN DIO16 IRT Product: Impact67 PN DIO16 M12L 4P Product: Impact67 PN DIO16 M12L 5P Product: Impact67 PN DO16 Product: IMPACT67 PN DO16 M12L 4P Product: IMPACT67 PN DO16 M12L 5P Product: Impact67 PN DO8/2 Product: IMPACT67 Pro PN DIO8 IOL8 M12L 4P Product: IMPACT67 Pro PN DIO8 IOL8 M12L 5P Product: MVK MPNIO DI16 Product: MVK MPNIO DI16 M12L 4P Product: MVK MPNIO DI16 M12L 5P Product: MVK MPNIO DI6 DO6 IOL2 IRT PP Product: MVK MPNIO DI8 DO8 +51 more

Summary

Several Murrelektronik devices using Profinet are shipped with the default SNMP community names ('public' for read access and 'private' for write access). If these community strings remain unchanged in the field, an unauthenticated attacker with network access to the device can read its configuration and, depending on the writable OIDs, modify device settings.

Details

Impact
An unauthenticated attacker with network access to an affected device can read sensitive configuration data via SNMP read access (loss of confidentiality). With write access to the 'private' community, the attacker can modify device parameters exposed via writable OIDs, which may disrupt device operation or alter the behaviour of connected industrial processes (loss of integrity and potential loss of availability).

General Recommendation
* Configure the device or upstream network equipment (firewall, managed switch) to only accept SNMP queries from explicitly authorized management stations. Use ACLs to block all other sources from reaching UDP port 161 of the device.
* Place affected devices in a dedicated OT or management VLAN that is isolated from general office, guest, and untrusted networks. Block UDP/161 at the network perimeter and between zones to prevent lateral SNMP queries.
* Enable network monitoring, logging, or IDS/IPS rules to detect unauthorized or anomalous SNMP queries directed at the affected devices. Investigate any SNMP write attempts ('private' community usage) as potential indicators of compromise.
* Ensure device management interfaces are not exposed to the internet or to other untrusted networks. Apply defense-in-depth principles by combining physical access control to the OT environment with network-level access restrictions.

Remediation
No vendor fix is currently available for the majority of affected products.
A firmware update addressing vulnerability is planned for early 2027 for the Impact67 Pro (article numbers 54620, 54630) and MVK Pro (article numbers 54600, 54610) product variants.

Vulnerabilities 1

  • Medium 5.9
    CVE-1999-0517 Public exploit EPSS 29%

    An SNMP community name is the default (e.g. public), null, or missing.

Revision history

  1. #1.0.0

    initial release

References