CVE-2019-10923

A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (All versions < V4.1.1 Patch 05), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 (All versions < V4.5.0 Patch 01), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P (All versions < V4.5.0), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.2.1), SIMATIC ET200M (incl. SIPLUS variants) (All versions), SIMATIC ET200S (incl. SIPLUS variants) (All versions), SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12 (All versions), SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12 (All versions), SIMATIC ET200ecoPN, 4AO U/I 4xM12 (All versions), SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12 (All versions), SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12 (All versions), SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12 (All versions), SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12 (All versions), SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12 (All versions), SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12 (All versions), SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12 (All versions), SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12 (All versions), SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12 (All versions), SIMATIC ET200ecoPN: IO-Link Master (All versions), SIMATIC ET200pro (All versions), SIMATIC NET CP 1604 (All versions < V2.8), SIMATIC NET CP 1616 (All versions < V2.8), SIMATIC PN/PN Coupler 6ES7158-3AD01-0XA0 (incl. SIPLUS NET variant) (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC WinAC RTX (F) 2010 (All versions < SIMATIC WinAC RTX 2010 SP3), SIMOTION (incl. SIPLUS variants) (All versions), SINAMICS DCM (All versions < V1.5 HF1), SINAMICS DCP (All versions < V1.3), SINAMICS G110M V4.7 Control Unit (All versions < V4.7 SP10 HF5), SINAMICS G120 V4.7 Control Unit (incl. SIPLUS variants) (All versions < V4.7 SP10 HF5), SINAMICS G130 V4.7 Control Unit (All versions < V4.7 HF29), SINAMICS G150 Control Unit (All versions < V4.8), SINAMICS GH150 V4.7 Control Unit (All versions), SINAMICS GL150 V4.7 Control Unit (All versions), SINAMICS GM150 V4.7 Control Unit (All versions), SINAMICS S110 Control Unit (All versions), SINAMICS S120 V4.7 Control Unit and CBE20 (incl. SIPLUS variants) (All versions < V4.7 HF34), SINAMICS S150 Control Unit (All versions < V4.8), SINAMICS SL150 V4.7 Control Unit (All versions < V4.7 HF33), SINAMICS SM120 V4.7 Control Unit (All versions), SINUMERIK 828D (All versions < V4.8 SP5), SINUMERIK 840D sl (All versions). An attacker with network access to an affected product may cause a Denial-of-Service condition by breaking the real-time synchronization (IRT) of the affected installation. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected installation. No user interaction is required to exploit this security vulnerability. The vulnerability impacts the availability of the affected installations.
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:siemens:cp1604_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp1604:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:cp1616_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp1616:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:siemens:dk_standard_ethernet_controller_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:dk_standard_ethernet_controller_firmware:4.1.1:-:*:*:*:*:*:*
cpe:2.3:o:siemens:dk_standard_ethernet_controller_firmware:4.1.1:p4:*:*:*:*:*:*
cpe:2.3:h:siemens:dk_standard_ethernet_controller:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:siemens:ek-ertec_200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ek-ertec_200_firmware:4.5.0:-:*:*:*:*:*:*
cpe:2.3:h:siemens:ek-ertec_200:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:siemens:ek-ertec_200p_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ek-ertec_200p:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:siemens:scalance_x-200irt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x-200irt:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:siemens:simatic_et_200m_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_et_200m:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:siemens:simatic_et_200s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_et_200s:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:siemens:simatic_et_200ecopn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_et_200ecopn:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:siemens:simatic_pn\/pn_coupler_6es7158-3ad01-0xa0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_pn\/pn_coupler_6es7158-3ad01-0xa0:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_312_ifm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu_312_ifm:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_313_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu_313:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_314_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu_314:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_314_ifm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu_314_ifm:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_315_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu_315:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_315-2_dp_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu_315-2_dp:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_316-2_dp_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu_316-2_dp:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-300_cpu_318-2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-300_cpu_318-2:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-400_v6_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-400_v6:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-400_pn_v7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-400_pn_v7:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:siemens:simatic_s7-400_dp_v7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_s7-400_dp_v7:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
OR cpe:2.3:o:siemens:simatic_winac_rtx_\(f\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_winac_rtx_\(f\)_firmware:2010:-:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_winac_rtx_\(f\)_firmware:2010:sp1:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_winac_rtx_\(f\)_firmware:2010:sp2:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_winac_rtx_\(f\):-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:siemens:simotion_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simotion:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_dcm_firmware:1.5:-:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_dcm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_dcm:-:*:*:*:*:*:*:*

Configuration 26 (hide)

AND
cpe:2.3:o:siemens:sinamics_dcp_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_dcp:-:*:*:*:*:*:*:*

Configuration 27 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_g110m_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_g110m_firmware:4.7:-:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_g110m:-:*:*:*:*:*:*:*

Configuration 28 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_g120_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_g120_firmware:4.7:-:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_g120:-:*:*:*:*:*:*:*

Configuration 29 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_g130_firmware:4.7:-:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_g130_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_g130:-:*:*:*:*:*:*:*

Configuration 30 (hide)

AND
cpe:2.3:o:siemens:sinamics_g150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_g150:-:*:*:*:*:*:*:*

Configuration 31 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_gh150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_gh150_firmware:4.8:-:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_gh150:-:*:*:*:*:*:*:*

Configuration 32 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_gl150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_gl150_firmware:4.8:-:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_gl150:-:*:*:*:*:*:*:*

Configuration 33 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_gm150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_gm150_firmware:4.8:-:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_gm150:-:*:*:*:*:*:*:*

Configuration 34 (hide)

AND
cpe:2.3:o:siemens:sinamics_s110_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_s110:-:*:*:*:*:*:*:*

Configuration 35 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_s120_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_s120_firmware:4.7:-:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_s120:-:*:*:*:*:*:*:*

Configuration 36 (hide)

AND
cpe:2.3:o:siemens:sinamics_s150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_s150:-:*:*:*:*:*:*:*

Configuration 37 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_sl150_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_sl150_firmware:4.7:-:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_sl150:-:*:*:*:*:*:*:*

Configuration 38 (hide)

AND
cpe:2.3:o:siemens:sinamics_sm120_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_sm120:-:*:*:*:*:*:*:*

Configuration 39 (hide)

OR cpe:2.3:a:siemens:sinumerik_828d:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sinumerik_828d:4.8:sp1:*:*:*:*:*:*
cpe:2.3:a:siemens:sinumerik_828d:4.8:sp2:*:*:*:*:*:*
cpe:2.3:a:siemens:sinumerik_828d:4.8:sp3:*:*:*:*:*:*
cpe:2.3:a:siemens:sinumerik_828d:4.8:sp4:*:*:*:*:*:*
cpe:2.3:a:siemens:sinumerik_828d:4.8:-:*:*:*:*:*:*

Configuration 40 (hide)

cpe:2.3:a:siemens:sinumerik_840d_sl:*:*:*:*:*:*:*:*

Information

Published : 2019-10-10 14:15

Updated : 2022-02-09 16:15


NVD link : CVE-2019-10923

Mitre link : CVE-2019-10923


JSON object : View

Products Affected

siemens

  • sinamics_g120
  • simatic_s7-300_cpu_314_ifm_firmware
  • sinamics_gl150
  • simatic_s7-300_cpu_313_firmware
  • ek-ertec_200p_firmware
  • simatic_et_200m_firmware
  • simatic_winac_rtx_\(f\)_firmware
  • simatic_et_200m
  • sinamics_g130
  • sinamics_s120
  • cp1604
  • simatic_s7-300_cpu_315-2_dp
  • simatic_et_200ecopn
  • simatic_s7-300_cpu_314_firmware
  • dk_standard_ethernet_controller
  • ek-ertec_200_firmware
  • simotion
  • sinamics_g150
  • sinamics_dcm_firmware
  • sinamics_gl150_firmware
  • simatic_s7-400_v6_firmware
  • sinamics_sm120
  • simatic_s7-300_cpu_315_firmware
  • sinamics_s120_firmware
  • sinamics_dcp
  • simatic_s7-300_cpu_312_ifm_firmware
  • simatic_winac_rtx_\(f\)
  • scalance_x-200irt
  • simatic_s7-300_cpu_313
  • dk_standard_ethernet_controller_firmware
  • simatic_s7-300_cpu_315-2_dp_firmware
  • simotion_firmware
  • sinamics_g150_firmware
  • simatic_s7-300_cpu_316-2_dp
  • simatic_s7-400_v6
  • simatic_et_200s
  • simatic_s7-400_dp_v7
  • simatic_et_200ecopn_firmware
  • sinamics_s150_firmware
  • sinumerik_828d
  • sinamics_g120_firmware
  • sinamics_g110m
  • sinamics_s110_firmware
  • simatic_s7-300_cpu_316-2_dp_firmware
  • simatic_s7-300_cpu_318-2_firmware
  • sinamics_g130_firmware
  • cp1604_firmware
  • simatic_pn\/pn_coupler_6es7158-3ad01-0xa0_firmware
  • sinumerik_840d_sl
  • sinamics_sl150_firmware
  • simatic_s7-300_cpu_312_ifm
  • simatic_s7-300_cpu_315
  • simatic_s7-300_cpu_314
  • simatic_et_200s_firmware
  • simatic_s7-300_cpu_firmware
  • sinamics_g110m_firmware
  • ek-ertec_200
  • simatic_s7-300_cpu_314_ifm
  • sinamics_gm150
  • simatic_s7-400_pn_v7
  • cp1616
  • ek-ertec_200p
  • sinamics_s150
  • scalance_x-200irt_firmware
  • simatic_s7-400_dp_v7_firmware
  • sinamics_dcp_firmware
  • sinamics_dcm
  • sinamics_sm120_firmware
  • simatic_s7-300_cpu_318-2
  • simatic_s7-400_pn_v7_firmware
  • sinamics_gh150_firmware
  • sinamics_sl150
  • sinamics_s110
  • sinamics_gh150
  • simatic_pn\/pn_coupler_6es7158-3ad01-0xa0
  • simatic_s7-300_cpu
  • sinamics_gm150_firmware
  • cp1616_firmware
CWE
CWE-400

Uncontrolled Resource Consumption