PT-2019-3024 · Siemens · Tia Administrator

Published 2019-07-09 · Updated 2020-10-02 · CVE-2019-10915

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIA Administrator versions prior to V1.0 SP1 Upd1

Description The issue is related to a lack of authentication in the TIA Administrator software. This could allow an attacker to execute certain commands, potentially compromising the confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited by an attacker with local access to the system, requiring no privileges and no user interaction. At the time of reporting, there were no known public exploits of this issue.

Recommendations For versions prior to V1.0 SP1 Upd1, update to V1.0 SP1 Upd1 or later to resolve the issue. As a temporary workaround, consider restricting local access to the affected system to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

CWE-264

Related Identifiers

BDU:2019-03006

CVE-2019-10915

Affected Products

Tia Administrator

References · 8

• 🔥 https://github.com/jiansiting/CVE-2019-10915 · Exploit
• https://bdu.fstec.ru/vul/2019-03006 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10915 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-721298.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10915 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-834884.pdf · Patch
• https://us-cert.gov/ics/advisories/icsa-19-253-02 · Note
• http://securityfocus.com/bid/109124 · Note