PT-2019-3850 · Siemens · Simatic Winac Rtx 2010

Published 2019-10-08 · Updated 2020-10-16 · CVE-2019-13921

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC WinAC RTX (F) 2010 versions prior to SP3 Update 1

Description A vulnerability has been identified that could allow an unauthenticated attacker to trigger a denial-of-service condition by sending a large HTTP request to the executing service. The vulnerability can be exploited by an attacker with network access to the affected systems, requiring no system privileges and no user interaction. This could compromise the availability of the service provided by the software.

Recommendations For SIMATIC WinAC RTX (F) 2010 versions prior to SP3 Update 1, update to SP3 Update 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the service to minimize the risk of exploitation.

Fix

Resource Exhaustion

Improper Authentication

Weakness Enumeration

CWE-400

CWE-287

CWE-410

Related Identifiers

BDU:2019-04213

CVE-2019-13921

Affected Products

Simatic Winac Rtx 2010

References · 4

• https://osv.dev/vulnerability/CVE-2019-13921 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13921 · Security Note
• https://bdu.fstec.ru/vul/2019-04213 · Security Note