PT-2019-4787 · Siemens · Simatic Tdc Cp51M1

Published 2019-09-10 · Updated 2019-09-24 · CVE-2019-10937

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC TDC CP51M1 versions prior to V1.1.7

Description The issue is related to insufficient data validation when handling UDP traffic in the communication module of the Siemens SIMATIC TDC CP51M1. This can be exploited by a remote attacker to cause a Denial-of-Service condition by sending specially crafted UDP packets. The vulnerability affects the device's UDP communication and can be exploited without authentication, requiring no user interaction. Successful exploitation compromises the availability of the targeted system. There are no known public exploits of this issue at the time of reporting.

Recommendations For versions prior to V1.1.7, update to version V1.1.7 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-01365

CVE-2019-10937

Affected Products

Simatic Tdc Cp51M1

References · 5

• https://bdu.fstec.ru/vul/2020-01365 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-250618.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10937 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10937 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-19-253-05 · Note