{"containers": {"cna": {"affected": [{"product": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)", "vendor": "Siemens AG", "versions": [{"status": "affected", "version": "All versions >= V2.5 and < V20.8"}]}, {"product": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)", "vendor": "Siemens AG", "versions": [{"status": "affected", "version": "All versions >= V2.5 and < V2.8"}]}, {"product": "SIMATIC S7-1500 Software Controller", "vendor": "Siemens AG", "versions": [{"status": "affected", "version": "All versions >= V2.5 and < V20.8"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V2.5 and < V20.8), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.5 and < V2.8), SIMATIC S7-1500 Software Controller (All versions >= V2.5 and < V20.8). Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a Denial-of-Service condition. The vulnerability can be triggered if specially crafted UDP packets are sent to the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the device availability."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-04-02T21:49:46", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-750824.pdf"}, {"tags": ["x_refsource_MISC"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-042-11"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productcert@siemens.com", "ID": "CVE-2019-19281", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)", "version": {"version_data": [{"version_value": "All versions >= V2.5 and < V20.8"}]}}, {"product_name": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)", "version": {"version_data": [{"version_value": "All versions >= V2.5 and < V2.8"}]}}, {"product_name": "SIMATIC S7-1500 Software Controller", "version": {"version_data": [{"version_value": "All versions >= V2.5 and < V20.8"}]}}]}, "vendor_name": "Siemens AG"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V2.5 and < V20.8), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.5 and < V2.8), SIMATIC S7-1500 Software Controller (All versions >= V2.5 and < V20.8). Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a Denial-of-Service condition. The vulnerability can be triggered if specially crafted UDP packets are sent to the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the device availability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')"}]}]}, "references": {"reference_data": [{"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-750824.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-750824.pdf"}, {"name": "https://www.us-cert.gov/ics/advisories/icsa-20-042-11", "refsource": "MISC", "url": "https://www.us-cert.gov/ics/advisories/icsa-20-042-11"}]}}}}, "cveMetadata": {"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2019-19281", "datePublished": "2020-03-10T19:16:17", "dateReserved": "2019-11-26T00:00:00", "dateUpdated": "2020-04-02T21:49:46", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "11015DA0-2BA7-4F1A-9675-A2479760E6E7", "versionEndExcluding": "20.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_et_200sp_open_controller_cpu_1515sp_pc2:-:*:*:*:*:*:*:*", "matchCriteriaId": "30E3491F-8F4A-4C7D-960D-073AA41DB4D6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511-1_pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2514FAB-314D-4524-879A-BB338D125ADC", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1511-1_pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "F62F4050-F6C9-4C8F-8E09-F0AEEDB6B1FC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1513-1_pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "9030F7EC-1967-4EB6-9A81-8CC8A7E6D8F2", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1513-1_pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "D6663D66-5127-4F5D-B39D-50D3F88F4435", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1515-2_pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "36AD01AF-950E-4872-B035-E23FDF3F2FA1", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1515-2_pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "ABE9C79B-52A3-45F4-9DA5-6D61A6BF7753", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1516-3_pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D087916-0A96-400A-AAE0-0F002C9199BC", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1516-3_pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "439E1B3E-7174-4BAC-A11A-F4F37ABB7291", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1516-3_dp_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DF77D52-CC95-43C1-A512-F3B8E245663B", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1516-3_dp:-:*:*:*:*:*:*:*", "matchCriteriaId": "B5FD1F20-E507-4422-814D-19614CDB49B7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1517-3_pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "93D466BA-5B14-4937-A2B2-9AC0152FF7AA", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1517-3_pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "4C44E126-E4D9-44D8-B8B9-10F060D63A2B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1517-3_dp_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "81B3028C-259D-4AE5-A1E4-C4EC15144DD1", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1517-3_dp:-:*:*:*:*:*:*:*", "matchCriteriaId": "ABE53C35-490A-498B-8CAB-B874C0E17AF1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2127DA06-9654-41D9-A77E-C8DBE69C1B7D", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "4245AED2-3F58-40D0-BF8A-8E930E1730B7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_dp_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E68216BA-EA96-45EA-AF05-77F3EDE33B2C", "versionEndExcluding": "2.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_dp:-:*:*:*:*:*:*:*", "matchCriteriaId": "6772D5F3-35EE-4C94-B6D5-31500F440CCF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1507s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "77CE921E-E5AA-4921-B534-A52BCDA4DAEE", "versionEndExcluding": "20.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1507s:-:*:*:*:*:*:*:*", "matchCriteriaId": "39C1392C-38E2-4AF9-AF17-91B93BC6B9B8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1508s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "30E73D3B-0813-4769-AE38-B8FB474882D5", "versionEndExcluding": "20.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1508s:-:*:*:*:*:*:*:*", "matchCriteriaId": "46CBD063-6CF0-45E6-A9D1-C7F8709806AA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1507s_f_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "77BF38CD-E49D-4912-8DF7-190C36F1E806", "versionEndExcluding": "20.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1507s_f:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1ED29DF-8AC0-4BB6-ACE2-EBC0A2B87F96", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1508s_f_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "21D4BADD-1B65-4324-9B20-4DE77D5500FC", "versionEndExcluding": "20.8", "versionStartIncluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1508s_f:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2079B95-E885-4490-BCEA-62BBEAF9CB51", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V2.5 and < V20.8), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.5 and < V2.8), SIMATIC S7-1500 Software Controller (All versions >= V2.5 and < V20.8). Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a Denial-of-Service condition. The vulnerability can be triggered if specially crafted UDP packets are sent to the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the device availability."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incluyendo las variantes de SIPLUS) (todas las versiones posteriores a V2.5 incluy\u00e9ndola y anteriores a V20.8), SIMATIC S7-1500 CPU family (incluyendo las variantes de ET200 CPUs y SIPLUS relacionadas) (todas las versiones posteriores a V2.5 incluy\u00e9ndola y anteriores a V2.8), SIMATIC S7-1500 Software Controller (todas las versiones posteriores a V2.5 incluy\u00e9ndola y anteriores a V20.8). Los dispositivos afectados contienen una vulnerabilidad que permite a un atacante no autenticado activar una condici\u00f3n de denegaci\u00f3n de servicio. La vulnerabilidad puede ser desencadenada si paquetes UDP especialmente dise\u00f1ados son enviados hacia el dispositivo. La vulnerabilidad de seguridad podr\u00eda ser explotada por parte de un atacante con acceso de red a los sistemas afectados. Una explotaci\u00f3n con \u00e9xito no requiere privilegios system ni una interacci\u00f3n del usuario. Un atacante podr\u00eda usar la vulnerabilidad para comprometer la disponibilidad del dispositivo."}], "id": "CVE-2019-19281", "lastModified": "2020-04-02T22:15:13.380", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-10T20:15:18.897", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-750824.pdf"}, {"source": "productcert@siemens.com", "url": "https://www.us-cert.gov/ics/advisories/icsa-20-042-11"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "productcert@siemens.com", "type": "Secondary"}]}

{}