PT-2019-3024 · Siemens · Tia Administrator

Publicado 2019-07-09 · Atualizado 2020-10-02 · CVE-2019-10915

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIA Administrator versions prior to V1.0 SP1 Upd1

Description The issue is related to a lack of authentication in the TIA Administrator software. This could allow an attacker to execute certain commands, potentially compromising the confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited by an attacker with local access to the system, requiring no privileges and no user interaction. At the time of reporting, there were no known public exploits of this issue.

Recommendations For versions prior to V1.0 SP1 Upd1, update to V1.0 SP1 Upd1 or later to resolve the issue. As a temporary workaround, consider restricting local access to the affected system to minimize the risk of exploitation.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

CWE-264

Identificadores relacionados

BDU:2019-03006

CVE-2019-10915

Produtos afetados

Tia Administrator

Referências · 8

• 🔥 https://github.com/jiansiting/CVE-2019-10915 · Exploit
• https://bdu.fstec.ru/vul/2019-03006 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-10915 · Nota de Segurança
• https://us-cert.gov/ics/advisories/icsa-19-253-02 · Nota
• http://securityfocus.com/bid/109124 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-721298.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10915 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/pdf/ssa-834884.pdf · Correção