The authors of the Python code in question are Alexander Timorin and Dmitry Sklyarov of SCADA Strange Love research group, and have unfortunately made the code available before the Siemens had the opportunity patch the flaw or offer mitigations.
In order to be able to use the tool, an attacker must first capture TCP/IP traffic containing the authentication data in the challenge-response form, and then by using the script, tries out different passwords until it finds a match.
Until Siemens comes out with mitigation, users of the affected controllers should minimize the risk to their systems by unplugging control system devices from the Internet, put them behind firewalls and isolate them from the business network, and employ secure methods for remote access.
In the meantime, the script seems to have been incorporated in the popular John the Ripper password cracking tool.
ICS-CERT expressed its fear that the script can be adapted to be used against other vendor products.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.