CVE-2019-19282

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd3), SIMATIC BATCH V8.1 (All versions), SIMATIC BATCH V8.2 (All versions < V8.2 Upd12), SIMATIC BATCH V9.0 (All versions < V9.0 SP1 Upd5), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 1), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC Route Control V8.1 (All versions), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions < V9.0 Upd4), SIMATIC WinCC (TIA Portal) V13 (All versions < V13 SP2), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC (TIA Portal) V15.1 (All versions < V15.1 Update 5), SIMATIC WinCC (TIA Portal) V16 (All versions < V16 Update 1), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 1). Through specially crafted messages, when encrypted communication is enabled, an attacker with network access could use the vulnerability to compromise the availability of the system by causing a Denial-of-Service condition.
Successful exploitation requires no system privileges and no user interaction.

Se ha identificado una vulnerabilidad en OpenPCS 7 V8.1 (Todas las versiones), OpenPCS 7 V8.2 (Todas las versiones), OpenPCS 7 V9.0 (Todas las versiones anteriores a V9.0 Upd3), SIMATIC BATCH V8.1 (Todas las versiones), SIMATIC BATCH V8.2 (Todas las versiones), SIMATIC BATCH V9.0 (Todas las versiones anteriores a V9. 0 SP1 Upd5), SIMATIC NET PC Software V14 (Todas las versiones anteriores a V14 SP1 Update 14), SIMATIC NET PC Software V15 (Todas las versiones), SIMATIC NET PC Software V16 (Todas las versiones anteriores a V16 Update 1), SIMATIC PCS 7 V8.1 (Todas las versiones), SIMATIC PCS 7 V8.2 (Todas las versiones), SIMATIC PCS 7 V9.0 (Todas las versiones anteriores a V9. 0 SP3), SIMATIC Route Control V8.1 (Todas las versiones), SIMATIC Route Control V8.2 (Todas las versiones), SIMATIC Route Control V9.0 (Todas las versiones anteriores a V9.0 Upd4), SIMATIC WinCC (TIA Portal) V13 (Todas las versiones anteriores a V13 SP2), SIMATIC WinCC (TIA Portal) V14 (Todas las versiones anteriores a V14 SP1 Update 10), SIMATIC WinCC (TIA Portal) V15. 1 (Todas las versiones anteriores a V15.1 Update 5), SIMATIC WinCC (TIA Portal) V16 (Todas las versiones anteriores a V16 Update 1), SIMATIC WinCC V7.3 (Todas las versiones), SIMATIC WinCC V7.4 (Todas las versiones anteriores a V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (Todas las versiones anteriores a V7.5 SP1 Update 1). A través de mensajes especialmente diseñados, cuando la comunicación cifrada está habilitada, un atacante con acceso a la red podría utilizar la vulnerabilidad para comprometer la disponibilidad del sistema causando una condición de denegación de servicio. La explotación exitosa no requiere privilegios del sistema ni interacción del usuario

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-11-26 CVE Reserved
2020-03-10 CVE Published
2023-03-07 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-131: Incorrect Calculation of Buffer Size

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-270778.pdf	2023-04-11

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Siemens Search vendor "Siemens"		Openpcs 7 Search vendor "Siemens" for product "Openpcs 7"				9.0 Search vendor "Siemens" for product "Openpcs 7" and version "9.0"		-		Affected
Siemens Search vendor "Siemens"		Openpcs 7 Search vendor "Siemens" for product "Openpcs 7"				9.0_update_1 Search vendor "Siemens" for product "Openpcs 7" and version "9.0_update_1"		-		Affected
Siemens Search vendor "Siemens"		Simatic Batch Search vendor "Siemens" for product "Simatic Batch"				9.0 Search vendor "Siemens" for product "Simatic Batch" and version "9.0"		-		Affected
Siemens Search vendor "Siemens"		Simatic Batch Search vendor "Siemens" for product "Simatic Batch"				9.0 Search vendor "Siemens" for product "Simatic Batch" and version "9.0"		sp1		Affected
Siemens Search vendor "Siemens"		Simatic Batch Search vendor "Siemens" for product "Simatic Batch"				9.0 Search vendor "Siemens" for product "Simatic Batch" and version "9.0"		sp1_update_1		Affected
Siemens Search vendor "Siemens"		Simatic Batch Search vendor "Siemens" for product "Simatic Batch"				9.0 Search vendor "Siemens" for product "Simatic Batch" and version "9.0"		sp1_update_2		Affected
Siemens Search vendor "Siemens"		Simatic Batch Search vendor "Siemens" for product "Simatic Batch"				9.0 Search vendor "Siemens" for product "Simatic Batch" and version "9.0"		sp1_update_3		Affected
Siemens Search vendor "Siemens"		Simatic Batch Search vendor "Siemens" for product "Simatic Batch"				9.0 Search vendor "Siemens" for product "Simatic Batch" and version "9.0"		sp1_update_4		Affected
Siemens Search vendor "Siemens"		Simatic Net Pc Search vendor "Siemens" for product "Simatic Net Pc"				< 16 Search vendor "Siemens" for product "Simatic Net Pc" and version " < 16"		-		Affected
Siemens Search vendor "Siemens"		Simatic Net Pc Search vendor "Siemens" for product "Simatic Net Pc"				16 Search vendor "Siemens" for product "Simatic Net Pc" and version "16"		-		Affected
Siemens Search vendor "Siemens"		Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7"				8.1 Search vendor "Siemens" for product "Simatic Pcs 7" and version "8.1"		-		Affected
Siemens Search vendor "Siemens"		Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7"				8.2 Search vendor "Siemens" for product "Simatic Pcs 7" and version "8.2"		-		Affected
Siemens Search vendor "Siemens"		Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7"				9.0 Search vendor "Siemens" for product "Simatic Pcs 7" and version "9.0"		-		Affected
Siemens Search vendor "Siemens"		Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7"				9.0 Search vendor "Siemens" for product "Simatic Pcs 7" and version "9.0"		sp1		Affected
Siemens Search vendor "Siemens"		Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7"				9.0 Search vendor "Siemens" for product "Simatic Pcs 7" and version "9.0"		sp2		Affected
Siemens Search vendor "Siemens"		Simatic Route Control Search vendor "Siemens" for product "Simatic Route Control"				< 9.0 Search vendor "Siemens" for product "Simatic Route Control" and version " < 9.0"		-		Affected
Siemens Search vendor "Siemens"		Simatic Route Control Search vendor "Siemens" for product "Simatic Route Control"				9.0 Search vendor "Siemens" for product "Simatic Route Control" and version "9.0"		-		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		-		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_1		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_10		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_11		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_12		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_13		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_2		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_3		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_4		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_5		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_6		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_7		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_8		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4"		sp1_update_9		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5"		-		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5"		sp1		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				7.5.1 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5.1"		-		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				13 Search vendor "Siemens" for product "Simatic Wincc" and version "13"		-		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				13 Search vendor "Siemens" for product "Simatic Wincc" and version "13"		sp1		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				14.0.1 Search vendor "Siemens" for product "Simatic Wincc" and version "14.0.1"		-		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1"		-		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1"		update_1		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1"		update_2		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1"		update_3		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1"		update_4		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc"				16 Search vendor "Siemens" for product "Simatic Wincc" and version "16"		-		Affected