Details of VAR-202004-0712

ID

VAR-202004-0712

CVE

CVE-2019-19300

TITLE

Variety Siemens Product resource management error vulnerability ( CNVD-2020-23035 )

Trust: 0.8

DESCRIPTION

A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, KTK ATE530S, SIDOOR ATD430W, SIDOOR ATE530S COATED, SIDOOR ATE531S, SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0), SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0), SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0), SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0), SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0), SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0), SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants), SIMATIC ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L (6ES7144-6JF00-0BB0), SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L (6ES7148-6JE00-0BB0), SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L (6ES7148-6JG00-0BB0), SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L (6ES7148-6JJ00-0BB0), SIMATIC ET200ecoPN, DI 16x24VDC, M12-L (6ES7141-6BH00-0BB0), SIMATIC ET200ecoPN, DI 8x24VDC, M12-L (6ES7141-6BG00-0BB0), SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L (6ES7143-6BH00-0BB0), SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L (6ES7142-6BG00-0BB0), SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L (6ES7142-6BR00-0BB0), SIMATIC MICRO-DRIVE PDC, SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0), SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0), SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0), SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0), SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0), SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0), SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0), SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0), SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0), SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0), SIMATIC S7-400 H V6 and below CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIMATIC TDC CP51M1, SIMATIC TDC CPU555, SIMATIC WinAC RTX 2010 (6ES7671-0RC08-0YA0), SIMATIC WinAC RTX F 2010 (6ES7671-1RC08-0YA0), SINAMICS S/G Control Unit w. PROFINET, SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0), SIPLUS ET 200S IM 151-8 PN/DP CPU (6AG1151-8AB01-7AB0), SIPLUS ET 200S IM 151-8F PN/DP CPU (6AG1151-8FB01-2AB0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-2CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-4CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU00-1CN0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0), SIPLUS S7-300 CPU 314C-2 PN/DP (6AG1314-6EH04-7AB0), SIPLUS S7-300 CPU 315-2 PN/DP (6AG1315-2EH14-7AB0), SIPLUS S7-300 CPU 315F-2 PN/DP (6AG1315-2FJ14-2AB0), SIPLUS S7-300 CPU 317-2 PN/DP (6AG1317-2EK14-7AB0), SIPLUS S7-300 CPU 317F-2 PN/DP (6AG1317-2FK14-2AB0). The Interniche-based TCP Stack can be forced to make very expensive calls for every incoming packet which can lead to a denial of service. Several Siemens products contain resource exhaustion vulnerabilities.Service operation interruption (DoS) It may be put into a state. are all products of the German Siemens (Siemens) company. SIMATIC S7-1500 CPU is a CPU (Central Processing Unit) module. SIMATIC S7-1500 is a programmable logic controller. SIMATIC TDC CP51M1 is an industrial Ethernet communication module of the SIMATIC TDC automation system. Many Siemens products have resource management error vulnerabilities, which can be exploited by attackers to cause denial of service. A vulnerability has been identified in KTK ATE530S (All versions), SIDOOR ATD430W (All versions), SIDOOR ATE530S COATED (All versions), SIDOOR ATE531S (All versions), SIMATIC ET 200SP Interfacemodul IM 155-6 MF HF (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions < V2.0), SIMATIC ET200MP IM155-5 PN HF (incl. SIPLUS variants) (All versions >= V4.2), SIMATIC ET200SP IM155-6 PN HA (incl. SIPLUS variants) (All versions >= V4.2), SIMATIC MICRO-DRIVE PDC (All versions), SIMATIC PN/PN Coupler (incl. PROFINET (All versions)

Trust: 2.97

sources: NVD: CVE-2019-19300 // JVNDB: JVNDB-2019-015236 // CNVD: CNVD-2020-23035 // IVD: 27a9c9bb-8adf-48d6-b6bd-c1000a913454 // IVD: 53646c4d-c67e-442c-b6e5-e05576895f55 // IVD: b989cd8a-d784-43d6-b848-6040a850cda1 // IVD: 40b4fa3b-5945-486b-8125-8431896d5661 // VULMON: CVE-2019-19300

IOT TAXONOMY

category:	['ICS']	sub_category:	-	Trust: 0.8
category:	['ICS', 'Network device']	sub_category:	-	Trust: 0.6

AFFECTED PRODUCTS

vendor:	simatic et200sp im155 6 pn 2 hf	model:	-	scope:	eq	version:	*	Trust: 1.6
vendor:	siemens	model:	simatic et 200sp open controller cpu 1515sp pc	scope:	lt	version:	2.0	Trust: 1.6
vendor:	siemens	model:	simatic s7-1500	scope:	lt	version:	2.0	Trust: 1.6
vendor:	siemens	model:	simatic et 200sp open controller cpu 1515sp pc2	scope:	lt	version:	2.0	Trust: 1.6
vendor:	siemens	model:	ktk ate530s	scope:	-	version:	-	Trust: 1.4
vendor:	siemens	model:	sidoor atd430w	scope:	-	version:	-	Trust: 1.4
vendor:	siemens	model:	sidoor ate530s coated	scope:	-	version:	-	Trust: 1.4
vendor:	siemens	model:	sidoor ate531s	scope:	-	version:	-	Trust: 1.4
vendor:	siemens	model:	simatic s7-300 cpu	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic et200sp im155-6 pn ha	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic s7-410 cpu	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic tdc cpu555	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1516f-3 pn\/dp	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic micro-drive pdc	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1511f-1 pn	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1511-1 pn	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	sidoor ate530s coated	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic et200sp im155-6 mf hf	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	sidoor atd430w	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic winac rtx \ 2010	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1513f-1 pn	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic pn\/pn coupler	scope:	lte	version:	4.2	Trust: 1.0
vendor:	siemens	model:	sidoor ate531s	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1513-1 pn	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1515-2 pn	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518f-4 pn\/dp	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1516-3 pn\/dp	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1515f-2 pn	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1517-3 pn\/dp	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic et200mp im155-5 pn hf	scope:	lte	version:	4.2	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1517f-3 pn\/dp	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518-4 pn\/dp	scope:	lt	version:	2.0	Trust: 1.0
vendor:	siemens	model:	sinamics s\/g control unit	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic tdc cp51m1	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic et200sp im155-6 pn\/2 hf	scope:	lte	version:	4.2	Trust: 1.0
vendor:	siemens	model:	simatic s7-400 pn\/dp	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	ktk ate530s	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic et200sp im155-6 pn hf	scope:	lte	version:	4.2	Trust: 1.0
vendor:	ktk ate530s	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic et200sp im155 6 pn hf	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic micro drive pdc	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic pn pn coupler	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1511 1 pn	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1513 1 pn	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1515 2 pn	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1516 3 pn dp	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1517 3 pn dp	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	sidoor atd430w	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1518 4 pn dp	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1511f 1 pn	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1513f 1 pn	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1515f 2 pn	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1516f 3 pn dp	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1517f 3 pn dp	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500 cpu 1518f 4 pn dp	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 1500	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 300 cpu	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 400 pn dp	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	sidoor ate530s coated	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic s7 410 cpu	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic tdc cp51m1	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic tdc cpu555	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic winac rtx f 2010	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	sinamics s g control unit	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	sidoor ate531s	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic et 200sp open controller cpu 1515sp pc	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic et 200sp open controller cpu 1515sp pc2	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic et200mp im155 5 pn hf	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic et200sp im155 6 mf hf	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	simatic et200sp im155 6 pn ha	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	siemens	model:	simatic et 200 sp open controller cpu 1515sp pc	scope:	eq	version:	2.0	Trust: 0.8
vendor:	siemens	model:	simatic et 200 sp open controller cpu 1515sp pc2	scope:	eq	version:	2.0	Trust: 0.8
vendor:	siemens	model:	simatic et 200mp im 155-5 pn hf	scope:	eq	version:	4.2	Trust: 0.8
vendor:	siemens	model:	simatic et200sp im155-6 mf hf	scope:	eq	version:	4.2	Trust: 0.8
vendor:	siemens	model:	simatic et200sp im155-6 pn ha	scope:	eq	version:	4.2	Trust: 0.8
vendor:	siemens	model:	simatic et200sp im155-6 pn hf	scope:	eq	version:	4.2	Trust: 0.8
vendor:	siemens	model:	simatic s7-300	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic et200sp im155-6 mf hf	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic et200mp im155-5 pn hf	scope:	gte	version:	4.2	Trust: 0.6
vendor:	siemens	model:	simatic et200sp im155-6 pn hf	scope:	gte	version:	4.2	Trust: 0.6
vendor:	siemens	model:	simatic pn/pn coupler	scope:	gte	version:	4.2	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 software controller	scope:	lt	version:	2.0	Trust: 0.6
vendor:	siemens	model:	simatic s7-410	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic tdc cp51m1	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic et200sp im155-6 pn ha	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic et200sp im155-6 pn/2 hf	scope:	gte	version:	4.2	Trust: 0.6
vendor:	siemens	model:	simatic et200sp im155-6 pn/3 hf.simatic micro-drive pdc	scope:	gte	version:	4.2	Trust: 0.6
vendor:	siemens	model:	simatic micro-drive pdc	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic s7-400 pn/dp	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic tdc cpu555	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic winac rtx 2010	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	sinamics s/g control unit w. profinet	scope:	-	version:	-	Trust: 0.6

sources: IVD: 27a9c9bb-8adf-48d6-b6bd-c1000a913454 // IVD: 53646c4d-c67e-442c-b6e5-e05576895f55 // IVD: b989cd8a-d784-43d6-b848-6040a850cda1 // IVD: 40b4fa3b-5945-486b-8125-8431896d5661 // CNVD: CNVD-2020-23035 // JVNDB: JVNDB-2019-015236 // NVD: CVE-2019-19300

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-19300
value:	HIGH
Trust: 1.0
productcert@siemens.com:	CVE-2019-19300
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2019-015236
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-23035
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202004-801
value:	HIGH
Trust: 0.6
IVD:	27a9c9bb-8adf-48d6-b6bd-c1000a913454
value:	HIGH
Trust: 0.2
IVD:	53646c4d-c67e-442c-b6e5-e05576895f55
value:	HIGH
Trust: 0.2
IVD:	b989cd8a-d784-43d6-b848-6040a850cda1
value:	HIGH
Trust: 0.2
IVD:	40b4fa3b-5945-486b-8125-8431896d5661
value:	HIGH
Trust: 0.2
VULMON:	CVE-2019-19300
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-19300
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2019-015236
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-23035
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	27a9c9bb-8adf-48d6-b6bd-c1000a913454
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	53646c4d-c67e-442c-b6e5-e05576895f55
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	b989cd8a-d784-43d6-b848-6040a850cda1
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	40b4fa3b-5945-486b-8125-8431896d5661
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2019-19300
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 2.0
NVD:	JVNDB-2019-015236
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: IVD: 27a9c9bb-8adf-48d6-b6bd-c1000a913454 // IVD: 53646c4d-c67e-442c-b6e5-e05576895f55 // IVD: b989cd8a-d784-43d6-b848-6040a850cda1 // IVD: 40b4fa3b-5945-486b-8125-8431896d5661 // CNVD: CNVD-2020-23035 // VULMON: CVE-2019-19300 // JVNDB: JVNDB-2019-015236 // CNNVD: CNNVD-202004-801 // NVD: CVE-2019-19300 // NVD: CVE-2019-19300

PROBLEMTYPE DATA

problemtype:

CWE-400

Trust: 1.8

sources: JVNDB: JVNDB-2019-015236 // NVD: CVE-2019-19300

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-801

TYPE

Resource management error

Trust: 1.4

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015236

PATCH

title:	SSA-593272	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-593272.pdf	Trust: 0.8
title:	Patch for Multiple Siemens product resource management error vulnerabilities (CNVD-2020-23035)	url:	https://www.cnvd.org.cn/patchInfo/show/214037	Trust: 0.6
title:	Siemens Security Advisories: Siemens Security Advisory	url:	https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=b6bdf7c5a64c5efcddeb45b5831983cf	Trust: 0.1

sources: CNVD: CNVD-2020-23035 // VULMON: CVE-2019-19300 // JVNDB: JVNDB-2019-015236

EXTERNAL IDS

db:	NVD	id:	CVE-2019-19300	Trust: 3.9
db:	ICS CERT	id:	ICSA-20-105-08	Trust: 2.1
db:	SIEMENS	id:	SSA-593272	Trust: 1.7
db:	CNVD	id:	CNVD-2020-23035	Trust: 1.4
db:	CNNVD	id:	CNNVD-202004-801	Trust: 1.4
db:	JVN	id:	JVNVU95499848	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-015236	Trust: 0.8
db:	AUSCERT	id:	ESB-2020.1345	Trust: 0.6
db:	IVD	id:	27A9C9BB-8ADF-48D6-B6BD-C1000A913454	Trust: 0.2
db:	IVD	id:	53646C4D-C67E-442C-B6E5-E05576895F55	Trust: 0.2
db:	IVD	id:	B989CD8A-D784-43D6-B848-6040A850CDA1	Trust: 0.2
db:	IVD	id:	40B4FA3B-5945-486B-8125-8431896D5661	Trust: 0.2
db:	VULMON	id:	CVE-2019-19300	Trust: 0.1

sources: IVD: 27a9c9bb-8adf-48d6-b6bd-c1000a913454 // IVD: 53646c4d-c67e-442c-b6e5-e05576895f55 // IVD: b989cd8a-d784-43d6-b848-6040a850cda1 // IVD: 40b4fa3b-5945-486b-8125-8431896d5661 // CNVD: CNVD-2020-23035 // VULMON: CVE-2019-19300 // JVNDB: JVNDB-2019-015236 // CNNVD: CNNVD-202004-801 // NVD: CVE-2019-19300

REFERENCES

url:	https://www.us-cert.gov/ics/advisories/icsa-20-105-08	Trust: 2.7
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-593272.pdf	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-19300	Trust: 1.4
url:	https://cert-portal.siemens.com/productcert/html/ssa-593272.html	Trust: 1.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-19300	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu95499848/index.html	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.1345/	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-20-105-08	Trust: 0.6
url:	https://vigilance.fr/vulnerability/simatic-denial-of-service-via-interniche-segmentsmack-32022	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/400.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.cisa.gov/uscert/ics/advisories/icsa-20-105-08	Trust: 0.1

sources: CNVD: CNVD-2020-23035 // VULMON: CVE-2019-19300 // JVNDB: JVNDB-2019-015236 // CNNVD: CNNVD-202004-801 // NVD: CVE-2019-19300

CREDITS

Siemens reported this vulnerability to CISA.

Trust: 0.6

sources: CNNVD: CNNVD-202004-801

SOURCES

db:	IVD	id:	27a9c9bb-8adf-48d6-b6bd-c1000a913454
db:	IVD	id:	53646c4d-c67e-442c-b6e5-e05576895f55
db:	IVD	id:	b989cd8a-d784-43d6-b848-6040a850cda1
db:	IVD	id:	40b4fa3b-5945-486b-8125-8431896d5661
db:	CNVD	id:	CNVD-2020-23035
db:	VULMON	id:	CVE-2019-19300
db:	JVNDB	id:	JVNDB-2019-015236
db:	CNNVD	id:	CNNVD-202004-801
db:	NVD	id:	CVE-2019-19300

LAST UPDATE DATE

2024-08-14T13:54:42.864000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-23035	date:	2020-04-16T00:00:00
db:	VULMON	id:	CVE-2019-19300	date:	2022-06-14T00:00:00
db:	JVNDB	id:	JVNDB-2019-015236	date:	2020-04-21T00:00:00
db:	CNNVD	id:	CNNVD-202004-801	date:	2023-02-15T00:00:00
db:	NVD	id:	CVE-2019-19300	date:	2024-07-09T12:15:05.190

SOURCES RELEASE DATE

db:	IVD	id:	27a9c9bb-8adf-48d6-b6bd-c1000a913454	date:	2020-04-14T00:00:00
db:	IVD	id:	53646c4d-c67e-442c-b6e5-e05576895f55	date:	2020-04-14T00:00:00
db:	IVD	id:	b989cd8a-d784-43d6-b848-6040a850cda1	date:	2020-04-14T00:00:00
db:	IVD	id:	40b4fa3b-5945-486b-8125-8431896d5661	date:	2020-04-14T00:00:00
db:	CNVD	id:	CNVD-2020-23035	date:	2020-04-16T00:00:00
db:	VULMON	id:	CVE-2019-19300	date:	2020-04-14T00:00:00
db:	JVNDB	id:	JVNDB-2019-015236	date:	2020-04-20T00:00:00
db:	CNNVD	id:	CNNVD-202004-801	date:	2020-04-14T00:00:00
db:	NVD	id:	CVE-2019-19300	date:	2020-04-14T20:15:14.903