7.1
CVE-2019-13939
- EPSS 0.35%
- Published 16.01.2020 16:15:16
- Last modified 10.06.2025 16:15:33
- Source productcert@siemens.com
- Teams watchlist Login
- Open Login
A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC00-U (All versions >= V2.3x and < V6.00.327), Desigo PXC001-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC100-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC12-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC128-U (All versions >= V2.3x and < V6.00.327), Desigo PXC200-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC36.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC50-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC64-U (All versions >= V2.3x and < V6.00.327), Desigo PXM20-E (All versions >= V2.3 < V6.0.327), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus Source Code (All versions), SIMOTICS CONNECT 400 (All versions < V0.3.0.330), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value.
Data is provided by the National Vulnerability Database (NVD)
Siemens ≫ Nucleus Readystart Version < 2017.02.2
Siemens ≫ Apogee Modular Equiment Controller Firmware Version < 2.8.2
Siemens ≫ Apogee Modular Building Controller Firmware Version < 2.8.2
Siemens ≫ Apogee Pxc Firmware Version <= 2.8.2
Siemens ≫ Desigo Pxc Firmware Version >= 2.3
Siemens ≫ Desigo Pxm20 Firmware Version >= 2.3
Siemens ≫ Simotics Connect 400 Firmware Version <= 0.3.0.95
Siemens ≫ Talon Tc Firmware Version >= 3.0
Siemens ≫ Desigo Pxc00-e.D Firmware Version >= 2.3.0 < 6.00.327
Siemens ≫ Desigo Pxc00-u Firmware Version >= 2.3.0 < 6.00.327
Siemens ≫ Desigo Pxc001-e.D Firmware Version >= 2.3.0 < 6.00.327
Siemens ≫ Desigo Pxc12-e.D Firmware Version >= 2.3.0 < 6.00.327
Siemens ≫ Desigo Pxc22-e.D Firmware Version >= 2.3.0 < 6.00.327
Siemens ≫ Desigo Pxc22.1-e.D Firmware Version >= 2.3.0 < 6.00.327
Siemens ≫ Desigo Pxc36.1-e.D Firmware Version >= 2.3.0 < 6.00.327
Siemens ≫ Desigopxc50-e.D Firmware Version-
Siemens ≫ Desigopxc64-u Firmware Version-
Siemens ≫ Desigopxc100-e.D Firmware Version-
Siemens ≫ Desigopxc128-u Firmware Version-
Siemens ≫ Desigopxc200-e.D Firmware Version-
Siemens ≫ Desigopxm20-e Firmware Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.35% | 0.563 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 6.5 | 4.9 |
AV:A/AC:L/Au:N/C:N/I:P/A:P
|
| productcert@siemens.com | 7.1 | 0 | 0 |
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| nvd@nist.gov | 7.1 | 2.8 | 4.2 |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
|
| productcert@siemens.com | 7.1 | 2.8 | 4.2 |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.