Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-10917 (GCVE-0-2019-10917)
Vulnerability from cvelistv5 – Published: 2019-05-14 19:54 – Updated: 2024-08-04 22:40
VLAI?
EPSS
Summary
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Severity ?
No CVSS data available.
CWE
- CWE-248 - Uncaught Exception
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Siemens AG | SIMATIC PCS 7 V8.0 and earlier |
Affected:
All versions
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:40:15.224Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SIMATIC PCS 7 V8.0 and earlier",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "SIMATIC PCS 7 V8.1",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V8.1 with WinCC V7.3 Upd 19"
}
]
},
{
"product": "SIMATIC PCS 7 V8.2",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11"
}
]
},
{
"product": "SIMATIC PCS 7 V9.0",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11"
}
]
},
{
"product": "SIMATIC WinCC (TIA Portal) V13",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "SIMATIC WinCC (TIA Portal) V14",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V14 SP1 Upd 9"
}
]
},
{
"product": "SIMATIC WinCC (TIA Portal) V15",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V15.1 Upd 3"
}
]
},
{
"product": "SIMATIC WinCC Runtime Professional V13",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "SIMATIC WinCC Runtime Professional V14",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V14.1 Upd 8"
}
]
},
{
"product": "SIMATIC WinCC Runtime Professional V15",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V15.1 Upd 3"
}
]
},
{
"product": "SIMATIC WinCC V7.2 and earlier",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "SIMATIC WinCC V7.3",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V7.3 Upd 19"
}
]
},
{
"product": "SIMATIC WinCC V7.4",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V7.4 SP1 Upd 11"
}
]
},
{
"product": "SIMATIC WinCC V7.5",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V7.5 Upd 3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-23T19:28:02.000Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2019-10917",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SIMATIC PCS 7 V8.0 and earlier",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIMATIC PCS 7 V8.1",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V8.1 with WinCC V7.3 Upd 19"
}
]
}
},
{
"product_name": "SIMATIC PCS 7 V8.2",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11"
}
]
}
},
{
"product_name": "SIMATIC PCS 7 V9.0",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11"
}
]
}
},
{
"product_name": "SIMATIC WinCC (TIA Portal) V13",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIMATIC WinCC (TIA Portal) V14",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V14 SP1 Upd 9"
}
]
}
},
{
"product_name": "SIMATIC WinCC (TIA Portal) V15",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V15.1 Upd 3"
}
]
}
},
{
"product_name": "SIMATIC WinCC Runtime Professional V13",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIMATIC WinCC Runtime Professional V14",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V14.1 Upd 8"
}
]
}
},
{
"product_name": "SIMATIC WinCC Runtime Professional V15",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V15.1 Upd 3"
}
]
}
},
{
"product_name": "SIMATIC WinCC V7.2 and earlier",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIMATIC WinCC V7.3",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V7.3 Upd 19"
}
]
}
},
{
"product_name": "SIMATIC WinCC V7.4",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V7.4 SP1 Upd 11"
}
]
}
},
{
"product_name": "SIMATIC WinCC V7.5",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V7.5 Upd 3"
}
]
}
}
]
},
"vendor_name": "Siemens AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-248: Uncaught Exception"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"name": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2019-10917",
"datePublished": "2019-05-14T19:54:48.000Z",
"dateReserved": "2019-04-08T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:40:15.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2019-10917",
"date": "2026-05-10",
"epss": "0.00045",
"percentile": "0.13937"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"8.0\", \"matchCriteriaId\": \"78F045C4-8DC2-4FA8-833D-B430EA26F2A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"858628AC-EA69-4D72-AE23-77A4A8DE2547\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4A75F15-8F47-4348-A85C-D94BBA8F9992\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3F27A96F-58B7-492F-8CF7-DE04D4EDAAD8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"7.2\", \"matchCriteriaId\": \"23B89914-E5BA-4670-B692-092AE9FFE148\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8D6229A2-9B8E-4F76-8425-589D2CE58B16\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F64B795A-7E66-49AE-BE40-E8EEAC12D280\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7D3A0BA7-EDC9-428D-A9C9-1CF602CEDFB5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_wincc_\\\\(tia_portal\\\\):13.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3D1A823-CE50-441F-B060-DA678DFE24FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_wincc_\\\\(tia_portal\\\\):14.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"28A1BA01-7A92-4368-8A73-8FA47A08BC53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_wincc_\\\\(tia_portal\\\\):15.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0256663E-3A97-4E99-995D-7446804DB496\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E07DBA91-379C-40F5-8C45-6EC302F5CA7D\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.\"}, {\"lang\": \"es\", \"value\": \"Se ha identificado una vulnerabilidad en SIMATIC PCS 7 V8.0 y anteriores (Todas las versiones), SIMATIC PCS 7 V8.1 (Todas las versiones anteriores a la versi\\u00f3n V8.1 con WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (Todas las versiones anteriores V8.2 SP1 con WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (Todas las versiones anteriores a la versi\\u00f3n V9.0 SP2 con WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (Todas las versiones), SIMATIC WinCC (TIA Portal) V14 (Todas las versiones \"}]",
"id": "CVE-2019-10917",
"lastModified": "2024-11-21T04:20:08.790",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2019-05-14T20:29:02.387",
"references": "[{\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf\", \"source\": \"productcert@siemens.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.us-cert.gov/ics/advisories/ICSA-19-134-08\", \"source\": \"productcert@siemens.com\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.us-cert.gov/ics/advisories/ICSA-19-134-08\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}]",
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"productcert@siemens.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-248\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-755\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2019-10917\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2019-05-14T20:29:02.387\",\"lastModified\":\"2024-11-21T04:20:08.790\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en SIMATIC PCS 7 V8.0 y anteriores (Todas las versiones), SIMATIC PCS 7 V8.1 (Todas las versiones anteriores a la versi\u00f3n V8.1 con WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (Todas las versiones anteriores V8.2 SP1 con WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (Todas las versiones anteriores a la versi\u00f3n V9.0 SP2 con WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (Todas las versiones), SIMATIC WinCC (TIA Portal) V14 (Todas las versiones \"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-248\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0\",\"matchCriteriaId\":\"78F045C4-8DC2-4FA8-833D-B430EA26F2A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"858628AC-EA69-4D72-AE23-77A4A8DE2547\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4A75F15-8F47-4348-A85C-D94BBA8F9992\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F27A96F-58B7-492F-8CF7-DE04D4EDAAD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.2\",\"matchCriteriaId\":\"23B89914-E5BA-4670-B692-092AE9FFE148\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D6229A2-9B8E-4F76-8425-589D2CE58B16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F64B795A-7E66-49AE-BE40-E8EEAC12D280\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D3A0BA7-EDC9-428D-A9C9-1CF602CEDFB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_wincc_\\\\(tia_portal\\\\):13.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3D1A823-CE50-441F-B060-DA678DFE24FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_wincc_\\\\(tia_portal\\\\):14.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28A1BA01-7A92-4368-8A73-8FA47A08BC53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_wincc_\\\\(tia_portal\\\\):15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0256663E-3A97-4E99-995D-7446804DB496\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E07DBA91-379C-40F5-8C45-6EC302F5CA7D\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.us-cert.gov/ics/advisories/ICSA-19-134-08\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.us-cert.gov/ics/advisories/ICSA-19-134-08\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}"
}
}
GSD-2019-10917
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-10917",
"description": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
"id": "GSD-2019-10917"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-10917"
],
"details": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
"id": "GSD-2019-10917",
"modified": "2023-12-13T01:23:59.559615Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2019-10917",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SIMATIC PCS 7 V8.0 and earlier",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIMATIC PCS 7 V8.1",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V8.1 with WinCC V7.3 Upd 19"
}
]
}
},
{
"product_name": "SIMATIC PCS 7 V8.2",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11"
}
]
}
},
{
"product_name": "SIMATIC PCS 7 V9.0",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11"
}
]
}
},
{
"product_name": "SIMATIC WinCC (TIA Portal) V13",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIMATIC WinCC (TIA Portal) V14",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V14 SP1 Upd 9"
}
]
}
},
{
"product_name": "SIMATIC WinCC (TIA Portal) V15",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V15.1 Upd 3"
}
]
}
},
{
"product_name": "SIMATIC WinCC Runtime Professional V13",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIMATIC WinCC Runtime Professional V14",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V14.1 Upd 8"
}
]
}
},
{
"product_name": "SIMATIC WinCC Runtime Professional V15",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V15.1 Upd 3"
}
]
}
},
{
"product_name": "SIMATIC WinCC V7.2 and earlier",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIMATIC WinCC V7.3",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V7.3 Upd 19"
}
]
}
},
{
"product_name": "SIMATIC WinCC V7.4",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V7.4 SP1 Upd 11"
}
]
}
},
{
"product_name": "SIMATIC WinCC V7.5",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V7.5 Upd 3"
}
]
}
}
]
},
"vendor_name": "Siemens AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-248: Uncaught Exception"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"name": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):14.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):15.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):13.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2019-10917"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-755"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"name": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
},
"lastModifiedDate": "2021-11-02T19:30Z",
"publishedDate": "2019-05-14T20:29Z"
}
}
}
VAR-201905-1324
Vulnerability from variot - Updated: 2023-12-18 12:28A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. plural SIMATIC The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Siemens SIMATIC PCS 7 and SIMATIC WinCC are products of Siemens AG, Germany. SIMATIC PCS 7 is a process control system. SIMATIC WinCC is an automated data acquisition and monitoring (SCADA) system. An input validation error vulnerability exists in Siemens SIMATIC PCS 7 and SIMATIC WinCC that originated from a network system or product that did not properly validate the entered data. service. Siemens SIMATIC products are prone to following security vulnerabilities: 1. A denial-of-service vulnerability 2. An SQL injection vulnerability3. 3. An arbitrary command execution Exploiting these vulnerabilities could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, bypass security restrictions, or execute arbitrary code or cause a denial of service condition. The following Siemens SIMATIC products are affected: SIMATIC PCS 7 version 8.0 and prior SIMATIC PCS 7 version 8.1 SIMATIC PCS 7 version 8.2 SIMATIC PCS 7 version 9.0 SIMATIC WinCC (TIA Portal) version 13 SIMATIC WinCC (TIA Portal) version 14 SIMATIC WinCC (TIA Portal) version 15 SIMATIC WinCC Runtime Professional, all version SIMATIC WinCC version 7.2 and prior SIMATIC WinCC version 7.3 SIMATIC WinCC version 7.4 SIMATIC WinCC version 7.5, all version prior to version 7.5 Update 3
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201905-1324",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "simatic wincc runtime professional",
"scope": null,
"trust": 1.4,
"vendor": "siemens",
"version": null
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 1.3,
"vendor": "siemens",
"version": "7.5"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 1.3,
"vendor": "siemens",
"version": "7.4"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 1.3,
"vendor": "siemens",
"version": "7.3"
},
{
"model": "simatic wincc \\",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "15.0"
},
{
"model": "simatic pcs 7",
"scope": "lte",
"trust": 1.0,
"vendor": "siemens",
"version": "8.0"
},
{
"model": "simatic pcs 7",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "8.2"
},
{
"model": "simatic wincc \\",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "13.0"
},
{
"model": "simatic wincc",
"scope": "lte",
"trust": 1.0,
"vendor": "siemens",
"version": "7.2"
},
{
"model": "simatic wincc runtime professional",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "*"
},
{
"model": "simatic wincc \\",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "14.0"
},
{
"model": "simatic pcs 7",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "simatic pcs 7",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "8.1"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.9,
"vendor": "siemens",
"version": "v13"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.9,
"vendor": "siemens",
"version": "v14"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.9,
"vendor": "siemens",
"version": "v15"
},
{
"model": "simatic pcs 7",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "8.1.x"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "7.3.x"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "7.5 upd3"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "13.x"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "14.x"
},
{
"model": "simatic wincc",
"scope": "lt",
"trust": 0.8,
"vendor": "siemens",
"version": "7.5"
},
{
"model": "simatic pcs 7",
"scope": "lte",
"trust": 0.8,
"vendor": "siemens",
"version": "8.0 and earlier"
},
{
"model": "simatic pcs 7",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "8.2.x"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "7.4.x"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "15.x"
},
{
"model": "simatic wincc",
"scope": "lte",
"trust": 0.8,
"vendor": "siemens",
"version": "7.2 and earlier"
},
{
"model": "simatic pcs 7",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "9.0.x"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "7v8.2"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "7v8.0"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "7v8.1"
},
{
"model": "simatic wincc",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=7.2"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "7v9.0"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "v7.3"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "v7.4"
},
{
"model": "simatic wincc upd3",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "v7.5.*\u003cv7.5"
},
{
"model": "simatic wincc runtime professional",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.2"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "6.2"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "79.0"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "78.2"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "78.1"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "78.0"
},
{
"model": "simatic pcs",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "77"
},
{
"model": "simatic wincc update",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "7.53"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic pcs 7",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic pcs 7",
"version": "8.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic pcs 7",
"version": "8.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic pcs 7",
"version": "9.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic wincc",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic wincc",
"version": "7.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic wincc",
"version": "7.4"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic wincc",
"version": "7.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic wincc tia portal",
"version": "13.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic wincc tia portal",
"version": "14.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic wincc tia portal",
"version": "15.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "simatic wincc runtime professional",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"db": "BID",
"id": "108404"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"db": "NVD",
"id": "CVE-2019-10917"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):14.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):15.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):13.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-10917"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vladimir Dashchenko and Sergey Temnikov from Kaspersky Lab, and ChengBin Wang from Guoli Security Technology, and ChengBin Wang from Guoli Security Technology reported these vulnerabilities to Siemens., CNCERT/CC",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
],
"trust": 0.6
},
"cve": "CVE-2019-10917",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 2.1,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-10917",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-14939",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "VHN-142511",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 5.5,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-10917",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-10917",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2019-14939",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201905-595",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-142511",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"db": "VULHUB",
"id": "VHN-142511"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"db": "NVD",
"id": "CVE-2019-10917"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. plural SIMATIC The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Siemens SIMATIC PCS 7 and SIMATIC WinCC are products of Siemens AG, Germany. SIMATIC PCS 7 is a process control system. SIMATIC WinCC is an automated data acquisition and monitoring (SCADA) system. An input validation error vulnerability exists in Siemens SIMATIC PCS 7 and SIMATIC WinCC that originated from a network system or product that did not properly validate the entered data. service. Siemens SIMATIC products are prone to following security vulnerabilities:\n1. A denial-of-service vulnerability\n2. An SQL injection vulnerability3. \n3. An arbitrary command execution\nExploiting these vulnerabilities could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, bypass security restrictions, or execute arbitrary code or cause a denial of service condition. \nThe following Siemens SIMATIC products are affected:\nSIMATIC PCS 7 version 8.0 and prior\nSIMATIC PCS 7 version 8.1\nSIMATIC PCS 7 version 8.2\nSIMATIC PCS 7 version 9.0\nSIMATIC WinCC (TIA Portal) version 13\nSIMATIC WinCC (TIA Portal) version 14\nSIMATIC WinCC (TIA Portal) version 15\nSIMATIC WinCC Runtime Professional, all version\nSIMATIC WinCC version 7.2 and prior\nSIMATIC WinCC version 7.3\nSIMATIC WinCC version 7.4\nSIMATIC WinCC version 7.5, all version prior to version 7.5 Update 3",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-10917"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"db": "BID",
"id": "108404"
},
{
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"db": "VULHUB",
"id": "VHN-142511"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-10917",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-19-134-08",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-697412",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-201905-595",
"trust": 0.9
},
{
"db": "BID",
"id": "108404",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2019-14939",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-19-134-02",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.1716.2",
"trust": 0.6
},
{
"db": "IVD",
"id": "DF80F7D1-C23D-4B6B-A4D2-D114F7117CD6",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-142511",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"db": "VULHUB",
"id": "VHN-142511"
},
{
"db": "BID",
"id": "108404"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"db": "NVD",
"id": "CVE-2019-10917"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
]
},
"id": "VAR-201905-1324",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"db": "VULHUB",
"id": "VHN-142511"
}
],
"trust": 1.5253826575
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"db": "CNVD",
"id": "CNVD-2019-14939"
}
]
},
"last_update_date": "2023-12-18T12:28:15.247000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-697412",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"title": "Patch for Siemens SIMATIC PCS 7 and SIMATIC WinCC Input Validation Error Vulnerability (CNVD-2019-14939)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/161831"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-755",
"trust": 1.1
},
{
"problemtype": "CWE-20",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-142511"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"db": "NVD",
"id": "CVE-2019-10917"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-134-08"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"trust": 1.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-19-134-08"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-10917"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/108404"
},
{
"trust": 0.9,
"url": "http://subscriber.communications.siemens.com/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10917"
},
{
"trust": 0.6,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-19-134-02-0"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/80946"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/simatic-wincc-multiple-vulnerabilities-29286"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"db": "VULHUB",
"id": "VHN-142511"
},
{
"db": "BID",
"id": "108404"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"db": "NVD",
"id": "CVE-2019-10917"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"db": "VULHUB",
"id": "VHN-142511"
},
{
"db": "BID",
"id": "108404"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"db": "NVD",
"id": "CVE-2019-10917"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-21T00:00:00",
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"date": "2019-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"date": "2019-05-14T00:00:00",
"db": "VULHUB",
"id": "VHN-142511"
},
{
"date": "2019-05-14T00:00:00",
"db": "BID",
"id": "108404"
},
{
"date": "2019-06-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"date": "2019-05-14T20:29:02.387000",
"db": "NVD",
"id": "CVE-2019-10917"
},
{
"date": "2019-05-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-14939"
},
{
"date": "2021-11-02T00:00:00",
"db": "VULHUB",
"id": "VHN-142511"
},
{
"date": "2019-05-22T06:00:00",
"db": "BID",
"id": "108404"
},
{
"date": "2019-07-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-004567"
},
{
"date": "2021-11-02T19:30:50.800000",
"db": "NVD",
"id": "CVE-2019-10917"
},
{
"date": "2021-11-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural SIMATIC Vulnerability related to input validation in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-004567"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input validation error",
"sources": [
{
"db": "IVD",
"id": "df80f7d1-c23d-4b6b-a4d2-d114f7117cd6"
},
{
"db": "BID",
"id": "108404"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-595"
}
],
"trust": 1.1
}
}
CERTFR-2019-AVI-207
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SIMATIC HMI Comfort Panels 4" - 22" versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SIMATIC WinCC (TIA Portal) versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SISHIP IPMS | ||
| Siemens | N/A | SIMATIC PCS 7 | ||
| Siemens | N/A | LOGO! Soft Comfort | ||
| Siemens | N/A | LOGO!8 BM | ||
| Siemens | N/A | SIMATIC HMI KTP Mobile Panels KTP400F,KTP700, KTP700F, KTP900 et KTP900F versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SIMATIC WinCC V7.5 versions antérieures à V7.5 Upd3 | ||
| Siemens | N/A | SIMATIC HMI Classic Devices (TP/MP/OP/MPMobile Panel) | ||
| Siemens | N/A | SINAMICS PERFECT HARMONY GH180 | ||
| Siemens | N/A | SISHIP IMAC | ||
| Siemens | N/A | SISHIP EMCS | ||
| Siemens | N/A | SIMATIC WinCC Runtime Advanced versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SCALANCE W1750D versions antérieures à V8.4.0.1 | ||
| Siemens | N/A | SIMATIC WinCC Runtime Professional versions antérieures à V15.1 Update 1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Comfort Panels 4\" - 22\" versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC (TIA Portal) versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SISHIP IPMS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "LOGO! Soft Comfort",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "LOGO!8 BM",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI KTP Mobile Panels KTP400F,KTP700, KTP700F, KTP900 et KTP900F versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC V7.5 versions ant\u00e9rieures \u00e0 V7.5 Upd3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Classic Devices (TP/MP/OP/MPMobile Panel)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAMICS PERFECT HARMONY GH180",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SISHIP IMAC",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SISHIP EMCS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC Runtime Advanced versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE W1750D versions ant\u00e9rieures \u00e0 V8.4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC Runtime Professional versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-7083",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7083"
},
{
"name": "CVE-2019-10919",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10919"
},
{
"name": "CVE-2019-10920",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10920"
},
{
"name": "CVE-2019-6572",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6572"
},
{
"name": "CVE-2018-16417",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16417"
},
{
"name": "CVE-2018-3991",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3991"
},
{
"name": "CVE-2019-10916",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10916"
},
{
"name": "CVE-2018-3990",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3990"
},
{
"name": "CVE-2018-3989",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3989"
},
{
"name": "CVE-2019-10922",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10922"
},
{
"name": "CVE-2019-10921",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10921"
},
{
"name": "CVE-2019-10924",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10924"
},
{
"name": "CVE-2019-10918",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10918"
},
{
"name": "CVE-2019-10917",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10917"
},
{
"name": "CVE-2018-7064",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7064"
},
{
"name": "CVE-2019-6578",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6578"
},
{
"name": "CVE-2018-7084",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7084"
},
{
"name": "CVE-2019-6576",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6576"
},
{
"name": "CVE-2019-6577",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6577"
},
{
"name": "CVE-2019-6574",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6574"
},
{
"name": "CVE-2018-7082",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7082"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-207",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-05-14T00:00:00.000000"
},
{
"description": "Ajout de SCADA dans le titre.",
"revision_date": "2019-05-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-705517 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705517.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-865156 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-865156.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-902727 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-606525 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-606525.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-549547 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-697412 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-804486 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-804486.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-102144 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-102144.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-542701 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf"
}
]
}
CERTFR-2019-AVI-207
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SIMATIC HMI Comfort Panels 4" - 22" versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SIMATIC WinCC (TIA Portal) versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SISHIP IPMS | ||
| Siemens | N/A | SIMATIC PCS 7 | ||
| Siemens | N/A | LOGO! Soft Comfort | ||
| Siemens | N/A | LOGO!8 BM | ||
| Siemens | N/A | SIMATIC HMI KTP Mobile Panels KTP400F,KTP700, KTP700F, KTP900 et KTP900F versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SIMATIC WinCC V7.5 versions antérieures à V7.5 Upd3 | ||
| Siemens | N/A | SIMATIC HMI Classic Devices (TP/MP/OP/MPMobile Panel) | ||
| Siemens | N/A | SINAMICS PERFECT HARMONY GH180 | ||
| Siemens | N/A | SISHIP IMAC | ||
| Siemens | N/A | SISHIP EMCS | ||
| Siemens | N/A | SIMATIC WinCC Runtime Advanced versions antérieures à V15.1 Update 1 | ||
| Siemens | N/A | SCALANCE W1750D versions antérieures à V8.4.0.1 | ||
| Siemens | N/A | SIMATIC WinCC Runtime Professional versions antérieures à V15.1 Update 1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Comfort Panels 4\" - 22\" versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC (TIA Portal) versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SISHIP IPMS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "LOGO! Soft Comfort",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "LOGO!8 BM",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI KTP Mobile Panels KTP400F,KTP700, KTP700F, KTP900 et KTP900F versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC V7.5 versions ant\u00e9rieures \u00e0 V7.5 Upd3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Classic Devices (TP/MP/OP/MPMobile Panel)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAMICS PERFECT HARMONY GH180",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SISHIP IMAC",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SISHIP EMCS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC Runtime Advanced versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE W1750D versions ant\u00e9rieures \u00e0 V8.4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC Runtime Professional versions ant\u00e9rieures \u00e0 V15.1 Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-7083",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7083"
},
{
"name": "CVE-2019-10919",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10919"
},
{
"name": "CVE-2019-10920",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10920"
},
{
"name": "CVE-2019-6572",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6572"
},
{
"name": "CVE-2018-16417",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16417"
},
{
"name": "CVE-2018-3991",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3991"
},
{
"name": "CVE-2019-10916",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10916"
},
{
"name": "CVE-2018-3990",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3990"
},
{
"name": "CVE-2018-3989",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3989"
},
{
"name": "CVE-2019-10922",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10922"
},
{
"name": "CVE-2019-10921",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10921"
},
{
"name": "CVE-2019-10924",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10924"
},
{
"name": "CVE-2019-10918",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10918"
},
{
"name": "CVE-2019-10917",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10917"
},
{
"name": "CVE-2018-7064",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7064"
},
{
"name": "CVE-2019-6578",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6578"
},
{
"name": "CVE-2018-7084",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7084"
},
{
"name": "CVE-2019-6576",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6576"
},
{
"name": "CVE-2019-6577",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6577"
},
{
"name": "CVE-2019-6574",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6574"
},
{
"name": "CVE-2018-7082",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7082"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-207",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-05-14T00:00:00.000000"
},
{
"description": "Ajout de SCADA dans le titre.",
"revision_date": "2019-05-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-705517 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705517.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-865156 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-865156.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-902727 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-606525 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-606525.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-549547 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-697412 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-804486 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-804486.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-102144 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-102144.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-542701 du 14 mai 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf"
}
]
}
BDU:2019-01859
Vulnerability from fstec - Published: 14.05.2019
VLAI Severity ?
Title
Уязвимость программного обеспечения продуктов Siemens SIMATIC, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю вызвать отказ в обслуживании
Description
Уязвимость программного обеспечения продуктов Siemens SIMATIC связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости может позволить нарушителю, имеющему доступ к файлу проекта, модифицировать его таким образом, чтобы при загрузке произошел отказ в обслуживании
Severity ?
Vendor
Siemens AG
Software Name
SIMATIC WinCC, SIMATIC PCS 7, SIMATIC WinCC (TIA Portal), SIMATIC WinCC Runtime Professional
Software Version
до 7.2 включительно (SIMATIC WinCC), до 7.5 Upd3 (SIMATIC WinCC), от V8.2 до V8.2 SP1 (SIMATIC PCS 7), до 9.0 SP2 (SIMATIC PCS 7), до 8.0 включительно (SIMATIC PCS 7), до V8.1 (SIMATIC PCS 7), от 14 до 14 SP1 Upd9 (SIMATIC WinCC (TIA Portal)), от 15 до 15.1 Upd 3 (SIMATIC WinCC (TIA Portal)), от V14 до V14.1 Upd 8 (SIMATIC WinCC Runtime Professional), от V15 до V15.1 Upd 3 (SIMATIC WinCC Runtime Professional), V13 (SIMATIC WinCC (TIA Portal)), V13 (SIMATIC WinCC Runtime Professional), от 7.3 до 7.3 Upd 19 (SIMATIC WinCC), от 7.4 до 7.4 SP1 Upd11 (SIMATIC WinCC)
Possible Mitigations
Обновление программного обеспечения:
Для SIMATIC WinCC Runtime Professional V14 до V14.1 Upd 8:
https://support.industry.siemens.com/cs/ww/en/view/109747394
Для SIMATIC WinCC Runtime Professional V15 до V15.1 Upd 3:
https://support.industry.siemens.com/cs/ww/en/view/109763892
Для SIMATIC WinCC от V7.5 включительно до V7.5 Upd3:
https://support.industry.siemens.com/cs/ww/en/view/109767227
Для SIMATIC PCS 7 V8.1 до V8.1 с WinCC V7.3 Upd 19:
https://support.industry.siemens.com/cs/ww/en/view/109768972
Для SIMATIC PCS 7 до V8.2 SP1:
https://support.industry.siemens.com/cs/ww/en/view/109768093
Для SIMATIC PCS 7 до V9.0 SP2:
https://support.industry.siemens.com/cs/ww/en/view/109768093
Для SIMATIC WinCC до V7.3 Upd 19:
https://support.industry.siemens.com/cs/ww/en/view/109768972
Для SIMATIC WinCC до V7.4 SP1 Upd 11:
https://support.industry.siemens.com/cs/ww/en/view/109768093
Для SIMATIC WinCC до V7.5 Upd 3:
https://support.industry.siemens.com/cs/ww/en/view/109767227
Для SIMATIC WinCC (TIA Portal) V14 до V14 SP1 Upd9:
https://support.industry.siemens.com/cs/ww/en/view/109747387
Для SIMATIC WinCC (TIA Portal) V15 до V15.1 Upd3:
https://support.industry.siemens.com/cs/ww/en/view/109763890
Для SIMATIC WinCC and SIMATIC PCS 7:
Включение функции "Зашифрованная связь"
Компенсирующие меры:
Применение глубокоэшелонированную защиту
Reference
https://nvd.nist.gov/vuln/detail/CVE-2019-10917
https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf
CWE
CWE-20
{
"CVSS 2.0": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Siemens AG",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 7.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SIMATIC WinCC), \u0434\u043e 7.5 Upd3 (SIMATIC WinCC), \u043e\u0442 V8.2 \u0434\u043e V8.2 SP1 (SIMATIC PCS 7), \u0434\u043e 9.0 SP2 (SIMATIC PCS 7), \u0434\u043e 8.0 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SIMATIC PCS 7), \u0434\u043e V8.1 (SIMATIC PCS 7), \u043e\u0442 14 \u0434\u043e 14 SP1 Upd9 (SIMATIC WinCC (TIA Portal)), \u043e\u0442 15 \u0434\u043e 15.1 Upd 3 (SIMATIC WinCC (TIA Portal)), \u043e\u0442 V14 \u0434\u043e V14.1 Upd 8 (SIMATIC WinCC Runtime Professional), \u043e\u0442 V15 \u0434\u043e V15.1 Upd 3 (SIMATIC WinCC Runtime Professional), V13 (SIMATIC WinCC (TIA Portal)), V13 (SIMATIC WinCC Runtime Professional), \u043e\u0442 7.3 \u0434\u043e 7.3 Upd 19 (SIMATIC WinCC), \u043e\u0442 7.4 \u0434\u043e 7.4 SP1 Upd11 (SIMATIC WinCC)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f:\n\u0414\u043b\u044f SIMATIC WinCC Runtime Professional V14 \u0434\u043e V14.1 Upd 8:\nhttps://support.industry.siemens.com/cs/ww/en/view/109747394\n\n\u0414\u043b\u044f SIMATIC WinCC Runtime Professional V15 \u0434\u043e V15.1 Upd 3:\nhttps://support.industry.siemens.com/cs/ww/en/view/109763892\n\n\u0414\u043b\u044f SIMATIC WinCC \u043e\u0442 V7.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e V7.5 Upd3:\nhttps://support.industry.siemens.com/cs/ww/en/view/109767227\n\n\u0414\u043b\u044f SIMATIC PCS 7 V8.1 \u0434\u043e V8.1 \u0441 WinCC V7.3 Upd 19:\nhttps://support.industry.siemens.com/cs/ww/en/view/109768972\n\n\u0414\u043b\u044f SIMATIC PCS 7 \u0434\u043e V8.2 SP1:\nhttps://support.industry.siemens.com/cs/ww/en/view/109768093\n\n\u0414\u043b\u044f SIMATIC PCS 7 \u0434\u043e V9.0 SP2:\nhttps://support.industry.siemens.com/cs/ww/en/view/109768093\n\n\u0414\u043b\u044f SIMATIC WinCC \u0434\u043e V7.3 Upd 19:\nhttps://support.industry.siemens.com/cs/ww/en/view/109768972\n\n\u0414\u043b\u044f SIMATIC WinCC \u0434\u043e V7.4 SP1 Upd 11:\nhttps://support.industry.siemens.com/cs/ww/en/view/109768093\n\n\u0414\u043b\u044f SIMATIC WinCC \u0434\u043e V7.5 Upd 3:\nhttps://support.industry.siemens.com/cs/ww/en/view/109767227\n\n\u0414\u043b\u044f SIMATIC WinCC (TIA Portal) V14 \u0434\u043e V14 SP1 Upd9:\nhttps://support.industry.siemens.com/cs/ww/en/view/109747387\n\n\u0414\u043b\u044f SIMATIC WinCC (TIA Portal) V15 \u0434\u043e V15.1 Upd3:\nhttps://support.industry.siemens.com/cs/ww/en/view/109763890\n\n\u0414\u043b\u044f SIMATIC WinCC and SIMATIC PCS 7:\n\u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \"\u0417\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0441\u0432\u044f\u0437\u044c\"\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n\u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0433\u043b\u0443\u0431\u043e\u043a\u043e\u044d\u0448\u0435\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.05.2019",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "31.05.2019",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2019-01859",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-10917",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SIMATIC WinCC, SIMATIC PCS 7, SIMATIC WinCC (TIA Portal), SIMATIC WinCC Runtime Professional",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Siemens SIMATIC, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Siemens SIMATIC \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0443 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u043b \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://nvd.nist.gov/vuln/detail/CVE-2019-10917\n\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 2,1)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}
ICSA-19-134-08
Vulnerability from csaf_cisa - Published: 2019-05-14 00:00 - Updated: 2019-10-08 00:00Summary
ICSA-19-134-08 Siemens SIMATIC PCS7, WinCC, TIA Portal (Update D)
Notes
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer: This CISA CSAF advisory was converted from Siemens ProductCERT's TXT advisory.
Critical infrastructure sectors: Multiple
Countries/areas deployed: Worldwide
Company headquarters location: Germany
Recommended Practices: CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices: Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices: Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices: When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
General Recommendations: As a general security measure, Siemens strongly recommends to protectnetwork access to devices with appropriate mechanisms. In order tooperate the devices in a protected IT environment, Siemens recommends toconfigure the environment according to Siemens' operational guidelinesfor Industrial Security (Download:https://www.siemens.com/cert/operational-guidelines-industrial-security),and to follow the recommendations in the product manuals.
General Recommendations: Additional information on Industrial Security by Siemens can be foundat: https://www.siemens.com/industrialsecurity
Terms of Use: Siemens Security Advisories are subject to the terms and conditions containedin Siemens' underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter "License Terms"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens' Global Website(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.
9.1 (Critical)
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SIMATIC PCS 7 V8.0 and earlier
Siemens / SIMATIC PCS 7 V8.0 and earlier
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V8.1
Siemens / SIMATIC PCS 7 V8.1
|
<V8.1_with_WinCC_V7.3_Upd_19 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V8.2
Siemens / SIMATIC PCS 7 V8.2
|
<V8.2_SP1_with_WinCC_V7.4_SP1_Upd11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V9.0
Siemens / SIMATIC PCS 7 V9.0
|
<V9.0_SP2_with_WinCC_V7.4_SP1_Upd11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V13
Siemens / SIMATIC WinCC (TIA Portal) V13
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V14
Siemens / SIMATIC WinCC (TIA Portal) V14
|
<V14_SP1_Upd_9 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V15
Siemens / SIMATIC WinCC (TIA Portal) V15
|
<V15.1_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V13
Siemens / SIMATIC WinCC Runtime Professional V13
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V14
Siemens / SIMATIC WinCC Runtime Professional V14
|
<V14.1_Upd_8 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V15
Siemens / SIMATIC WinCC Runtime Professional V15
|
<V15.1_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.2 and earlier
Siemens / SIMATIC WinCC V7.2 and earlier
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.3
Siemens / SIMATIC WinCC V7.3
|
<V7.3_Upd_19 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.4
Siemens / SIMATIC WinCC V7.4
|
<V7.4_SP1_Upd_11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.5
Siemens / SIMATIC WinCC V7.5
|
<V7.5_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
CWE-248
- Uncaught Exception
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SIMATIC PCS 7 V8.0 and earlier
Siemens / SIMATIC PCS 7 V8.0 and earlier
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V8.1
Siemens / SIMATIC PCS 7 V8.1
|
<V8.1_with_WinCC_V7.3_Upd_19 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V8.2
Siemens / SIMATIC PCS 7 V8.2
|
<V8.2_SP1_with_WinCC_V7.4_SP1_Upd11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V9.0
Siemens / SIMATIC PCS 7 V9.0
|
<V9.0_SP2_with_WinCC_V7.4_SP1_Upd11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V13
Siemens / SIMATIC WinCC (TIA Portal) V13
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V14
Siemens / SIMATIC WinCC (TIA Portal) V14
|
<V14_SP1_Upd_9 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V15
Siemens / SIMATIC WinCC (TIA Portal) V15
|
<V15.1_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V13
Siemens / SIMATIC WinCC Runtime Professional V13
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V14
Siemens / SIMATIC WinCC Runtime Professional V14
|
<V14.1_Upd_8 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V15
Siemens / SIMATIC WinCC Runtime Professional V15
|
<V15.1_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.2 and earlier
Siemens / SIMATIC WinCC V7.2 and earlier
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.3
Siemens / SIMATIC WinCC V7.3
|
<V7.3_Upd_19 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.4
Siemens / SIMATIC WinCC V7.4
|
<V7.4_SP1_Upd_11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.5
Siemens / SIMATIC WinCC V7.5
|
<V7.5_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
CWE-749
- Exposed Dangerous Method or Function
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SIMATIC PCS 7 V8.0 and earlier
Siemens / SIMATIC PCS 7 V8.0 and earlier
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V8.1
Siemens / SIMATIC PCS 7 V8.1
|
<V8.1_with_WinCC_V7.3_Upd_19 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V8.2
Siemens / SIMATIC PCS 7 V8.2
|
<V8.2_SP1_with_WinCC_V7.4_SP1_Upd11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC PCS 7 V9.0
Siemens / SIMATIC PCS 7 V9.0
|
<V9.0_SP2_with_WinCC_V7.4_SP1_Upd11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V13
Siemens / SIMATIC WinCC (TIA Portal) V13
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V14
Siemens / SIMATIC WinCC (TIA Portal) V14
|
<V14_SP1_Upd_9 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC (TIA Portal) V15
Siemens / SIMATIC WinCC (TIA Portal) V15
|
<V15.1_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V13
Siemens / SIMATIC WinCC Runtime Professional V13
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V14
Siemens / SIMATIC WinCC Runtime Professional V14
|
<V14.1_Upd_8 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC Runtime Professional V15
Siemens / SIMATIC WinCC Runtime Professional V15
|
<V15.1_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.2 and earlier
Siemens / SIMATIC WinCC V7.2 and earlier
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.3
Siemens / SIMATIC WinCC V7.3
|
<V7.3_Upd_19 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.4
Siemens / SIMATIC WinCC V7.4
|
<V7.4_SP1_Upd_11 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
|
|
SIMATIC WinCC V7.5
Siemens / SIMATIC WinCC V7.5
|
<V7.5_Upd_3 |
Vendor Fix
fix
Mitigation
Mitigation
Mitigation
|
References
Acknowledgments
Kaspersky Lab ICS CERT
Vladimir Dashchenko
Sergey Temnikov
CNCERT/CC for
ZheJiang Guoli Security Technology
ChengBin Wang
{
"document": {
"acknowledgments": [
{
"names": [
"Vladimir Dashchenko",
"Sergey Temnikov"
],
"organization": "Kaspersky Lab ICS CERT",
"summary": "coordinating disclosure of vulnerability CVE-2019-10916 and CVE-2019-10917"
},
{
"names": [
"CNCERT/CC for"
],
"summary": "coordinating disclosure of vulnerability CVE-2019-10918"
},
{
"names": [
"ChengBin Wang"
],
"organization": "ZheJiang Guoli Security Technology",
"summary": "coordinating disclosure of vulnerability CVE-2019-10918"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s TXT advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protectnetwork access to devices with appropriate mechanisms. In order tooperate the devices in a protected IT environment, Siemens recommends toconfigure the environment according to Siemens\u0027 operational guidelinesfor Industrial Security (Download:https://www.siemens.com/cert/operational-guidelines-industrial-security),and to follow the recommendations in the product manuals.",
"title": "General Recommendations"
},
{
"category": "general",
"text": "Additional information on Industrial Security by Siemens can be foundat: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions containedin Siemens\u0027 underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter \"License Terms\"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website(https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "central@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-697412: Multiple Vulnerabilities in SIMATIC WinCC, SIMATIC WinCC Runtime,SIMATIC PCS 7, SIMATIC TIA Portal",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-697412.txt"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-19-134-08 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/OT/white/2019/icsa-19-134-08.json"
},
{
"category": "self",
"summary": "ICSA Advisory ICSA-19-134-08 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-134-08"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "ICSA-19-134-08 Siemens SIMATIC PCS7, WinCC, TIA Portal (Update D)",
"tracking": {
"current_release_date": "2019-10-08T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-19-134-08",
"initial_release_date": "2019-05-14T00:00:00.000000Z",
"revision_history": [
{
"date": "2019-05-14T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2019-07-09T00:00:00.000000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added update for SIMATIC WinCC V7.4, SIMATIC PCS 7 V8.2 and SIMATIC PCS 7 V9.0"
},
{
"date": "2019-08-13T00:00:00.000000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added update for SIMATIC WinCC V7.3 and SIMATIC PCS 7 V8.1"
},
{
"date": "2019-09-10T00:00:00.000000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added update for SIMATIC WinCC Runtime Professional V14 and V15"
},
{
"date": "2019-10-08T00:00:00.000000Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Updated remediation for SIMATIC WinCC Runtime Professional V14 and V15 and added update for SIMATIC WinCC (TIA Portal) V14 and SIMATIC WinCC (TIA Portal) V15"
}
],
"status": "final",
"version": "5"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC PCS 7 V8.0 and earlier",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS 7 V8.0 and earlier"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV8.1_with_WinCC_V7.3_Upd_19",
"product": {
"name": "SIMATIC PCS 7 V8.1",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS 7 V8.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV8.2_SP1_with_WinCC_V7.4_SP1_Upd11",
"product": {
"name": "SIMATIC PCS 7 V8.2",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS 7 V8.2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV9.0_SP2_with_WinCC_V7.4_SP1_Upd11",
"product": {
"name": "SIMATIC PCS 7 V9.0",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS 7 V9.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC (TIA Portal) V13",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC (TIA Portal) V13"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV14_SP1_Upd_9",
"product": {
"name": "SIMATIC WinCC (TIA Portal) V14",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC (TIA Portal) V14"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV15.1_Upd_3",
"product": {
"name": "SIMATIC WinCC (TIA Portal) V15",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC (TIA Portal) V15"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC Runtime Professional V13",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Runtime Professional V13"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV14.1_Upd_8",
"product": {
"name": "SIMATIC WinCC Runtime Professional V14",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Runtime Professional V14"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV15.1_Upd_3",
"product": {
"name": "SIMATIC WinCC Runtime Professional V15",
"product_id": "CSAFPID-00010"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Runtime Professional V15"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC V7.2 and earlier",
"product_id": "CSAFPID-00011"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V7.2 and earlier"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.3_Upd_19",
"product": {
"name": "SIMATIC WinCC V7.3",
"product_id": "CSAFPID-00012"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V7.3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.4_SP1_Upd_11",
"product": {
"name": "SIMATIC WinCC V7.4",
"product_id": "CSAFPID-00013"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V7.4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.5_Upd_3",
"product": {
"name": "SIMATIC WinCC V7.5",
"product_id": "CSAFPID-00014"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V7.5"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10916",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10916"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C"
}
],
"remediations": [
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.3 Upd 19 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768972",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768972"
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0005"
]
},
{
"category": "vendor_fix",
"details": "Update to V14 SP1 Upd 9 - Download: https://support.industry.siemens.com/cs/ww/en/view/109747387",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109747387"
},
{
"category": "vendor_fix",
"details": "Update to V15.1 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109763890",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763890"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0008"
]
},
{
"category": "vendor_fix",
"details": "Update to V14.1 Upd 8 - Download: https://support.industry.siemens.com/cs/ww/en/view/109747394",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109747394"
},
{
"category": "vendor_fix",
"details": "Update to V15.1 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109763892",
"product_ids": [
"CSAFPID-00010"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763892"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-00011"
]
},
{
"category": "vendor_fix",
"details": "Update to V7.3 Upd 19 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768972",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768972"
},
{
"category": "vendor_fix",
"details": "Update to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "vendor_fix",
"details": "Update to V7.5 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109767227",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109767227"
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Apply Defense-in-Depth",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Enable \"Encrypted communication\" in SIMATIC WinCC and SIMATIC PCS 7.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Only open project files from trusted locations.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
}
]
},
{
"cve": "CVE-2019-10917",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"notes": [
{
"category": "summary",
"text": "An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10917"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"
}
],
"remediations": [
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.3 Upd 19 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768972",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768972"
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0005"
]
},
{
"category": "vendor_fix",
"details": "Update to V14 SP1 Upd 9 - Download: https://support.industry.siemens.com/cs/ww/en/view/109747387",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109747387"
},
{
"category": "vendor_fix",
"details": "Update to V15.1 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109763890",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763890"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0008"
]
},
{
"category": "vendor_fix",
"details": "Update to V14.1 Upd 8 - Download: https://support.industry.siemens.com/cs/ww/en/view/109747394",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109747394"
},
{
"category": "vendor_fix",
"details": "Update to V15.1 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109763892",
"product_ids": [
"CSAFPID-00010"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763892"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-00011"
]
},
{
"category": "vendor_fix",
"details": "Update to V7.3 Upd 19 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768972",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768972"
},
{
"category": "vendor_fix",
"details": "Update to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "vendor_fix",
"details": "Update to V7.5 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109767227",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109767227"
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Apply Defense-in-Depth",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Enable \"Encrypted communication\" in SIMATIC WinCC and SIMATIC PCS 7.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Only open project files from trusted locations.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
}
]
},
{
"cve": "CVE-2019-10918",
"cwe": {
"id": "CWE-749",
"name": "Exposed Dangerous Method or Function"
},
"notes": [
{
"category": "summary",
"text": "An authenticatd attacker with network access to the DCOM interface could execute arbitrary commands with SYSTEM privileges. The vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires authentication with a low-privileged user account and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10918"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"
}
],
"remediations": [
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.3 Upd 19 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768972",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768972"
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "vendor_fix",
"details": "Update WinCC to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0005"
]
},
{
"category": "vendor_fix",
"details": "Update to V14 SP1 Upd 9 - Download: https://support.industry.siemens.com/cs/ww/en/view/109747387",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109747387"
},
{
"category": "vendor_fix",
"details": "Update to V15.1 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109763890",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763890"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-0008"
]
},
{
"category": "vendor_fix",
"details": "Update to V14.1 Upd 8 - Download: https://support.industry.siemens.com/cs/ww/en/view/109747394",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109747394"
},
{
"category": "vendor_fix",
"details": "Update to V15.1 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109763892",
"product_ids": [
"CSAFPID-00010"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763892"
},
{
"category": "mitigation",
"details": " See recommendations from section Workaround and Mitigations",
"product_ids": [
"CSAFPID-00011"
]
},
{
"category": "vendor_fix",
"details": "Update to V7.3 Upd 19 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768972",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768972"
},
{
"category": "vendor_fix",
"details": "Update to V7.4 SP1 Upd 11 - Download: https://support.industry.siemens.com/cs/ww/en/view/109768093",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768093"
},
{
"category": "vendor_fix",
"details": "Update to V7.5 Upd 3 - Download: https://support.industry.siemens.com/cs/ww/en/view/109767227",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109767227"
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Apply Defense-in-Depth",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Enable \"Encrypted communication\" in SIMATIC WinCC and SIMATIC PCS 7.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
},
{
"category": "mitigation",
"details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Only open project files from trusted locations.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014"
]
}
]
}
]
}
FKIE_CVE-2019-10917
Vulnerability from fkie_nvd - Published: 2019-05-14 20:29 - Updated: 2024-11-21 04:20
Severity ?
Summary
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
References
| URL | Tags | ||
|---|---|---|---|
| productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf | Vendor Advisory | |
| productcert@siemens.com | https://www.us-cert.gov/ics/advisories/ICSA-19-134-08 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.us-cert.gov/ics/advisories/ICSA-19-134-08 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| siemens | simatic_pcs_7 | * | |
| siemens | simatic_pcs_7 | 8.1 | |
| siemens | simatic_pcs_7 | 8.2 | |
| siemens | simatic_pcs_7 | 9.0 | |
| siemens | simatic_wincc | * | |
| siemens | simatic_wincc | 7.3 | |
| siemens | simatic_wincc | 7.4 | |
| siemens | simatic_wincc | 7.5 | |
| siemens | simatic_wincc_\(tia_portal\) | 13.0 | |
| siemens | simatic_wincc_\(tia_portal\) | 14.0 | |
| siemens | simatic_wincc_\(tia_portal\) | 15.0 | |
| siemens | simatic_wincc_runtime_professional | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78F045C4-8DC2-4FA8-833D-B430EA26F2A0",
"versionEndIncluding": "8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "858628AC-EA69-4D72-AE23-77A4A8DE2547",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F4A75F15-8F47-4348-A85C-D94BBA8F9992",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3F27A96F-58B7-492F-8CF7-DE04D4EDAAD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*",
"matchCriteriaId": "23B89914-E5BA-4670-B692-092AE9FFE148",
"versionEndIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8D6229A2-9B8E-4F76-8425-589D2CE58B16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F64B795A-7E66-49AE-BE40-E8EEAC12D280",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7D3A0BA7-EDC9-428D-A9C9-1CF602CEDFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):13.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3D1A823-CE50-441F-B060-DA678DFE24FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "28A1BA01-7A92-4368-8A73-8FA47A08BC53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc_\\(tia_portal\\):15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0256663E-3A97-4E99-995D-7446804DB496",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E07DBA91-379C-40F5-8C45-6EC302F5CA7D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions \u003c V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions \u003c V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions \u003c V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known."
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad en SIMATIC PCS 7 V8.0 y anteriores (Todas las versiones), SIMATIC PCS 7 V8.1 (Todas las versiones anteriores a la versi\u00f3n V8.1 con WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (Todas las versiones anteriores V8.2 SP1 con WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (Todas las versiones anteriores a la versi\u00f3n V9.0 SP2 con WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (Todas las versiones), SIMATIC WinCC (TIA Portal) V14 (Todas las versiones "
}
],
"id": "CVE-2019-10917",
"lastModified": "2024-11-21T04:20:08.790",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-05-14T20:29:02.387",
"references": [
{
"source": "productcert@siemens.com",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"source": "productcert@siemens.com",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08"
}
],
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-248"
}
],
"source": "productcert@siemens.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-755"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-M4VW-C8VH-3C9G
Vulnerability from github – Published: 2022-05-24 16:45 – Updated: 2022-05-24 16:45
VLAI?
Details
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions), SIMATIC WinCC (TIA Portal) V15 (All versions), SIMATIC WinCC Runtime Professional (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 Upd3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
{
"affected": [],
"aliases": [
"CVE-2019-10917"
],
"database_specific": {
"cwe_ids": [
"CWE-755"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-14T20:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions), SIMATIC WinCC (TIA Portal) V15 (All versions), SIMATIC WinCC Runtime Professional (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions \u003c V7.5 Upd3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
"id": "GHSA-m4vw-c8vh-3c9g",
"modified": "2022-05-24T16:45:38Z",
"published": "2022-05-24T16:45:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10917"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/ICSA-19-134-08"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…