Lucene search

SiemensCVE-2019-10930

HistoryJul 11, 2019 - 10:15 p.m.

CVE-2019-10930

2019-07-1122:15:11

CWE-552

CWE-434

siemens

web.nvd.nist.gov

252

cve

vulnerability

siprotec 5

digsi 5

cpu variants

ethernet communication modules

remote attacker

file system

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

50.8%

JSON

A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions ), DIGSI 5 engineering software (All versions < V7.90), SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.90), SIPROTEC 5 device types 7SS85 and 7KE85 (All versions < V8.01), SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules (All versions). A remote attacker could use specially crafted packets sent to port 443/TCP to upload, download or delete files in certain parts of the file system.

Affected configurations

Nvd

Node

siemens6md85Match-

siemens6md86Match-

siemens6md89Match-

siemens7sa82Match-

siemens7sa86Match-

siemens7sa87Match-

siemens7sd82Match-

siemens7sd86Match-

siemens7sd87Match-

siemens7sj82Match-

siemens7sj85Match-

siemens7sj86Match-

siemens7sk82Match-

siemens7sk85Match-

siemens7sl82Match-

siemens7sl86Match-

siemens7sl87Match-

siemens7um85Match-

siemens7ut82Match-

siemens7ut85Match-

siemens7ut86Match-

siemens7ut87Match-

siemens7ve85Match-

siemens7vk87Match-

AND

siemensdigsi_5_engineering_softwareMatch7.90

siemenssiprotec_5_digsi_device_driverMatch7.90

VendorProductVersionCPE
siemens6md85-cpe:2.3:h:siemens:6md85:-:*:*:*:*:*:*:*
siemens6md86-cpe:2.3:h:siemens:6md86:-:*:*:*:*:*:*:*
siemens6md89-cpe:2.3:h:siemens:6md89:-:*:*:*:*:*:*:*
siemens7sa82-cpe:2.3:h:siemens:7sa82:-:*:*:*:*:*:*:*
siemens7sa86-cpe:2.3:h:siemens:7sa86:-:*:*:*:*:*:*:*
siemens7sa87-cpe:2.3:h:siemens:7sa87:-:*:*:*:*:*:*:*
siemens7sd82-cpe:2.3:h:siemens:7sd82:-:*:*:*:*:*:*:*
siemens7sd86-cpe:2.3:h:siemens:7sd86:-:*:*:*:*:*:*:*
siemens7sd87-cpe:2.3:h:siemens:7sd87:-:*:*:*:*:*:*:*
siemens7sj82-cpe:2.3:h:siemens:7sj82:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	6md85	-	cpe:2.3:h:siemens:6md85:-:::::::*
siemens	6md86	-	cpe:2.3:h:siemens:6md86:-:::::::*
siemens	6md89	-	cpe:2.3:h:siemens:6md89:-:::::::*
siemens	7sa82	-	cpe:2.3:h:siemens:7sa82:-:::::::*
siemens	7sa86	-	cpe:2.3:h:siemens:7sa86:-:::::::*
siemens	7sa87	-	cpe:2.3:h:siemens:7sa87:-:::::::*
siemens	7sd82	-	cpe:2.3:h:siemens:7sd82:-:::::::*
siemens	7sd86	-	cpe:2.3:h:siemens:7sd86:-:::::::*
siemens	7sd87	-	cpe:2.3:h:siemens:7sd87:-:::::::*
siemens	7sj82	-	cpe:2.3:h:siemens:7sj82:-:::::::*

Rows per page:

1-10 of 261

CNA Affected

[
  {
    "product": "All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "All versions "
      }
    ]
  },
  {
    "product": "DIGSI 5 engineering software",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V7.90"
      }
    ]
  },
  {
    "product": "SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V7.90"
      }
    ]
  },
  {
    "product": "SIPROTEC 5 device types 7SS85 and 7KE85",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V8.01"
      }
    ]
  },
  {
    "product": "SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-899560.pdf

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

50.8%

JSON

Related for CVE-2019-10930