Vulnetix
Try Vulnetix Request Demo
CVE-2019-10930 PUBLISHED CVSS 7.5 HIGH

A vulnerability has been identified in SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.90), All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions), DIGSI 5 engineering software (All versions < V7.90). A remote attacker could use specially crafted packets sent to port 443/TCP to upload, download or delete files in certain parts of the file system.

EPSS 0.47% · 64.5th percentile

Risk Scores

CVSS v3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
0.47%
64.5th percentile

Affected Products

VendorProductVersions
siemenssiprotec_5_digsi_device_driver7.90
Siemens AGAll other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modulesAll versions
Siemens AGSIPROTEC 5 device types 7SS85 and 7KE85All versions < V8.01
Siemens AGSIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modulesAll versions < V7.90
Siemens AGSIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modulesAll versions
siemensdigsi_5_engineering_software7.90
Siemens AGDIGSI 5 engineering softwareAll versions < V7.90

Timeline

References

Open in Interactive Console →