Sign-up

ID

VAR-201910-0916


CVE

CVE-2019-13921


TITLE

Siemens SIMATIC WinAC RTX (F) 2010 Denial of service vulnerability

Trust: 0.8

sources: IVD: c552b9fe-8f7d-4877-944f-fc9ce6b825ea // CNVD: CNVD-2019-34595

DESCRIPTION

A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software. SIMATIC WinAC RTX (F) 2010 Contains an authentication vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Siemens SIMATIC WinAC RTX (F) 2010 is a PC-based fail-safe SIMATIC software controller from Siemens (Germany). A denial of service vulnerability exists in Siemens SIMATIC WinAC RTX (F) 2010. At the time of advisory publication no public exploitation of this security vulnerability was known

Trust: 2.34

sources: NVD: CVE-2019-13921 // JVNDB: JVNDB-2019-010606 // CNVD: CNVD-2019-34595 // IVD: c552b9fe-8f7d-4877-944f-fc9ce6b825ea

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: c552b9fe-8f7d-4877-944f-fc9ce6b825ea // CNVD: CNVD-2019-34595

AFFECTED PRODUCTS

vendor:siemensmodel:simatic winac rtx \ 2010scope:eqversion:sp1

Trust: 1.0

vendor:siemensmodel:simatic winac rtx \ 2010scope:eqversion: -

Trust: 1.0

vendor:siemensmodel:simatic winac rtx \ 2010scope:eqversion:sp2

Trust: 1.0

vendor:siemensmodel:simatic winac rtx \ 2010scope:eqversion:*

Trust: 1.0

vendor:siemensmodel:simatic winac rtx f 2010scope: - version: -

Trust: 0.8

vendor:siemensmodel:simatic winac rtxscope:eqversion:2010

Trust: 0.6

vendor:simatic winac rtx f 2010model: - scope:eqversion:*

Trust: 0.2

sources: IVD: c552b9fe-8f7d-4877-944f-fc9ce6b825ea // CNVD: CNVD-2019-34595 // JVNDB: JVNDB-2019-010606 // NVD: CVE-2019-13921

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-13921
value: HIGH

Trust: 1.0

NVD: CVE-2019-13921
value: HIGH

Trust: 0.8

CNVD: CNVD-2019-34595
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201910-416
value: HIGH

Trust: 0.6

IVD: c552b9fe-8f7d-4877-944f-fc9ce6b825ea
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2019-13921
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-34595
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: c552b9fe-8f7d-4877-944f-fc9ce6b825ea
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2019-13921
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2019-13921
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: c552b9fe-8f7d-4877-944f-fc9ce6b825ea // CNVD: CNVD-2019-34595 // JVNDB: JVNDB-2019-010606 // CNNVD: CNNVD-201910-416 // NVD: CVE-2019-13921

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.0

problemtype:CWE-410

Trust: 1.0

problemtype:CWE-287

Trust: 0.8

sources: JVNDB: JVNDB-2019-010606 // NVD: CVE-2019-13921

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201910-416

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201910-416

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-010606

PATCH
title:SSA-878278url:https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf
Trust: 0.8
title:Patch for Siemens SIMATIC WinAC RTX (F) 2010 Denial of Service Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/184345
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-34595 // 
            
            
            
            JVNDB: JVNDB-2019-010606

EXTERNAL IDS
db:NVDid:CVE-2019-13921
Trust: 3.2
db:SIEMENSid:SSA-878278
Trust: 2.2
db:ICS CERTid:ICSA-19-281-03
Trust: 1.4
db:CNVDid:CNVD-2019-34595
Trust: 0.8
db:CNNVDid:CNNVD-201910-416
Trust: 0.8
db:JVNDBid:JVNDB-2019-010606
Trust: 0.8
db:AUSCERTid:ESB-2019.3778
Trust: 0.6
db:AUSCERTid:ESB-2019.3778.2
Trust: 0.6
db:IVDid:C552B9FE-8F7D-4877-944F-FC9CE6B825EA
Trust: 0.2
sources:
            
            
            IVD: c552b9fe-8f7d-4877-944f-fc9ce6b825ea // 
            
            
            
            CNVD: CNVD-2019-34595 // 
            
            
            
            JVNDB: JVNDB-2019-010606 // 
            
            
            
            CNNVD: CNNVD-201910-416 // 
            
            
            
            NVD: CVE-2019-13921

REFERENCES
url:https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf
Trust: 2.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-13921
Trust: 2.0
url:https://www.us-cert.gov/ics/advisories/icsa-19-281-03
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13921
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2019.3778.2/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.3778/
Trust: 0.6
url:https://vigilance.fr/vulnerability/simatic-winac-rtx-f-2010-denial-of-service-via-large-http-request-30560
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-34595 // 
            
            
            
            JVNDB: JVNDB-2019-010606 // 
            
            
            
            CNNVD: CNNVD-201910-416 // 
            
            
            
            NVD: CVE-2019-13921

SOURCES
db:IVDid:c552b9fe-8f7d-4877-944f-fc9ce6b825ea
db:CNVDid:CNVD-2019-34595
db:JVNDBid:JVNDB-2019-010606
db:CNNVDid:CNNVD-201910-416
db:NVDid:CVE-2019-13921

LAST UPDATE DATE
2024-08-14T14:26:09.068000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-34595date:2019-10-11T00:00:00
db:JVNDBid:JVNDB-2019-010606date:2019-12-26T00:00:00
db:CNNVDid:CNNVD-201910-416date:2020-10-21T00:00:00
db:NVDid:CVE-2019-13921date:2020-10-16T13:16:41.973

SOURCES RELEASE DATE
db:IVDid:c552b9fe-8f7d-4877-944f-fc9ce6b825eadate:2019-10-11T00:00:00
db:CNVDid:CNVD-2019-34595date:2019-10-11T00:00:00
db:JVNDBid:JVNDB-2019-010606date:2019-10-17T00:00:00
db:CNNVDid:CNNVD-201910-416date:2019-10-08T00:00:00
db:NVDid:CVE-2019-13921date:2019-10-10T14:15:14.783