PT-2019-2037 · Siemens · Siemens Plc

Published 2019-04-09 · Updated 2023-04-11 · CVE-2019-6568

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Siemens (affected versions not specified)

Description The issue is related to insufficient input validation in the web server of Siemens programmable logic controller (PLC) devices. This can be exploited by a remote attacker to cause a denial of service condition, potentially leading to a restart of the web server. The vulnerability can be exploited by an attacker with network access to the affected systems, requiring no system privileges or user interaction, which could compromise the availability of the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Out of bounds Read

Weakness Enumeration

CWE-20

CWE-125

Related Identifiers

BDU:2019-01782

CVE-2019-6568

Affected Products

Siemens Plc

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6568 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-530931.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6568 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01782 · Security Note