CVE-2019-19300

Description

A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, KTK ATE530S, SIDOOR ATD430W, SIDOOR ATE530S COATED, SIDOOR ATE531S, SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0), SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0), SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0), SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0), SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0), SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0), SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants), SIMATIC ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L (6ES7144-6JF00-0BB0), SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L (6ES7148-6JE00-0BB0), SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L (6ES7148-6JG00-0BB0), SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L (6ES7148-6JJ00-0BB0), SIMATIC ET200ecoPN, DI 16x24VDC, M12-L (6ES7141-6BH00-0BB0), SIMATIC ET200ecoPN, DI 8x24VDC, M12-L (6ES7141-6BG00-0BB0), SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L (6ES7143-6BH00-0BB0), SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L (6ES7142-6BG00-0BB0), SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L (6ES7142-6BR00-0BB0), SIMATIC MICRO-DRIVE PDC, SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0), SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0), SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0), SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0), SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0), SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0), SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0), SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0), SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0), SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0), SIMATIC S7-400 H V6 and below CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIMATIC TDC CP51M1, SIMATIC TDC CPU555, SIMATIC WinAC RTX 2010 (6ES7671-0RC08-0YA0), SIMATIC WinAC RTX F 2010 (6ES7671-1RC08-0YA0), SINAMICS S/G Control Unit w. PROFINET, SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0), SIPLUS ET 200S IM 151-8 PN/DP CPU (6AG1151-8AB01-7AB0), SIPLUS ET 200S IM 151-8F PN/DP CPU (6AG1151-8FB01-2AB0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-2CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-4CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU00-1CN0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0), SIPLUS S7-300 CPU 314C-2 PN/DP (6AG1314-6EH04-7AB0), SIPLUS S7-300 CPU 315-2 PN/DP (6AG1315-2EH14-7AB0), SIPLUS S7-300 CPU 315F-2 PN/DP (6AG1315-2FJ14-2AB0), SIPLUS S7-300 CPU 317-2 PN/DP (6AG1317-2EK14-7AB0), SIPLUS S7-300 CPU 317F-2 PN/DP (6AG1317-2FK14-2AB0). The Interniche-based TCP Stack can be forced to make very expensive calls for every incoming packet which can lead to a denial of service.

Category

7.5
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.47%
Vendor Advisory siemens.com
Affected: Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200
Affected: Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P
Affected: Siemens KTK ATE530S
Affected: Siemens SIDOOR ATD430W
Affected: Siemens SIDOOR ATE530S COATED
Affected: Siemens SIDOOR ATE531S
Affected: Siemens SIMATIC ET 200AL IM 157-1 PN
Affected: Siemens SIMATIC ET 200MP IM 155-5 PN HF
Affected: Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU
Affected: Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU
Affected: Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU
Affected: Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU
Affected: Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU
Affected: Siemens SIMATIC ET 200SP IM 155-6 MF HF
Affected: Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)
Affected: Siemens SIMATIC ET 200SP IM 155-6 PN HF
Affected: Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF
Affected: Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF
Affected: Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
Affected: Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
Affected: Siemens SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L
Affected: Siemens SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L
Affected: Siemens SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L
Affected: Siemens SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L
Affected: Siemens SIMATIC ET200ecoPN, DI 16x24VDC, M12-L
Affected: Siemens SIMATIC ET200ecoPN, DI 8x24VDC, M12-L
Affected: Siemens SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L
Affected: Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L
Affected: Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L
Affected: Siemens SIMATIC MICRO-DRIVE PDC
Affected: Siemens SIMATIC PN/MF Coupler
Affected: Siemens SIMATIC PN/PN Coupler
Affected: Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Affected: Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
Affected: Siemens SIMATIC S7-1500 Software Controller
Affected: Siemens SIMATIC S7-300 CPU 314C-2 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 315-2 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 315F-2 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 315T-3 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 317-2 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 317F-2 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 317T-3 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 319-3 PN/DP
Affected: Siemens SIMATIC S7-300 CPU 319F-3 PN/DP
Affected: Siemens SIMATIC S7-400 H V6 and below CPU family (incl. SIPLUS variants)
Affected: Siemens SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)
Affected: Siemens SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants)
Affected: Siemens SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)
Affected: Siemens SIMATIC TDC CP51M1
Affected: Siemens SIMATIC TDC CPU555
Affected: Siemens SIMATIC WinAC RTX 2010
Affected: Siemens SIMATIC WinAC RTX F 2010
Affected: Siemens SINAMICS S/G Control Unit w. PROFINET
Affected: Siemens SIPLUS ET 200MP IM 155-5 PN HF
Affected: Siemens SIPLUS ET 200MP IM 155-5 PN HF
Affected: Siemens SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL
Affected: Siemens SIPLUS ET 200S IM 151-8 PN/DP CPU
Affected: Siemens SIPLUS ET 200S IM 151-8F PN/DP CPU
Affected: Siemens SIPLUS ET 200SP IM 155-6 PN HF
Affected: Siemens SIPLUS ET 200SP IM 155-6 PN HF
Affected: Siemens SIPLUS ET 200SP IM 155-6 PN HF
Affected: Siemens SIPLUS ET 200SP IM 155-6 PN HF
Affected: Siemens SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL
Affected: Siemens SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL
Affected: Siemens SIPLUS ET 200SP IM 155-6 PN HF TX RAIL
Affected: Siemens SIPLUS NET PN/PN Coupler
Affected: Siemens SIPLUS S7-300 CPU 314C-2 PN/DP
Affected: Siemens SIPLUS S7-300 CPU 315-2 PN/DP
Affected: Siemens SIPLUS S7-300 CPU 315F-2 PN/DP
Affected: Siemens SIPLUS S7-300 CPU 317-2 PN/DP
Affected: Siemens SIPLUS S7-300 CPU 317F-2 PN/DP
Published at:
Updated at:

References

Link Tags
https://cert-portal.siemens.com/productcert/pdf/ssa-593272.pdf vendor advisory
https://cert-portal.siemens.com/productcert/html/ssa-593272.html

Frequently Asked Questions

What is the severity of CVE-2019-19300?
CVE-2019-19300 has been scored as a high severity vulnerability.
How to fix CVE-2019-19300?
To fix CVE-2019-19300, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2019-19300 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2019-19300 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-19300?
CVE-2019-19300 affects Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, Siemens KTK ATE530S, Siemens SIDOOR ATD430W, Siemens SIDOOR ATE530S COATED, Siemens SIDOOR ATE531S, Siemens SIMATIC ET 200AL IM 157-1 PN, Siemens SIMATIC ET 200MP IM 155-5 PN HF, Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU, Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU, Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU, Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU, Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU, Siemens SIMATIC ET 200SP IM 155-6 MF HF, Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants), Siemens SIMATIC ET 200SP IM 155-6 PN HF, Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF, Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants), Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), Siemens SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L, Siemens SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L, Siemens SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L, Siemens SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L, Siemens SIMATIC ET200ecoPN, DI 16x24VDC, M12-L, Siemens SIMATIC ET200ecoPN, DI 8x24VDC, M12-L, Siemens SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L, Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L, Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L, Siemens SIMATIC MICRO-DRIVE PDC, Siemens SIMATIC PN/MF Coupler, Siemens SIMATIC PN/PN Coupler, Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants), Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), Siemens SIMATIC S7-1500 Software Controller, Siemens SIMATIC S7-300 CPU 314C-2 PN/DP, Siemens SIMATIC S7-300 CPU 315-2 PN/DP, Siemens SIMATIC S7-300 CPU 315F-2 PN/DP, Siemens SIMATIC S7-300 CPU 315T-3 PN/DP, Siemens SIMATIC S7-300 CPU 317-2 PN/DP, Siemens SIMATIC S7-300 CPU 317F-2 PN/DP, Siemens SIMATIC S7-300 CPU 317T-3 PN/DP, Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP, Siemens SIMATIC S7-300 CPU 319-3 PN/DP, Siemens SIMATIC S7-300 CPU 319F-3 PN/DP, Siemens SIMATIC S7-400 H V6 and below CPU family (incl. SIPLUS variants), Siemens SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants), Siemens SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants), Siemens SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), Siemens SIMATIC TDC CP51M1, Siemens SIMATIC TDC CPU555, Siemens SIMATIC WinAC RTX 2010, Siemens SIMATIC WinAC RTX F 2010, Siemens SINAMICS S/G Control Unit w. PROFINET, Siemens SIPLUS ET 200MP IM 155-5 PN HF, Siemens SIPLUS ET 200MP IM 155-5 PN HF, Siemens SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL, Siemens SIPLUS ET 200S IM 151-8 PN/DP CPU, Siemens SIPLUS ET 200S IM 151-8F PN/DP CPU, Siemens SIPLUS ET 200SP IM 155-6 PN HF, Siemens SIPLUS ET 200SP IM 155-6 PN HF, Siemens SIPLUS ET 200SP IM 155-6 PN HF, Siemens SIPLUS ET 200SP IM 155-6 PN HF, Siemens SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL, Siemens SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL, Siemens SIPLUS ET 200SP IM 155-6 PN HF TX RAIL, Siemens SIPLUS NET PN/PN Coupler, Siemens SIPLUS S7-300 CPU 314C-2 PN/DP, Siemens SIPLUS S7-300 CPU 315-2 PN/DP, Siemens SIPLUS S7-300 CPU 315F-2 PN/DP, Siemens SIPLUS S7-300 CPU 317-2 PN/DP, Siemens SIPLUS S7-300 CPU 317F-2 PN/DP.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.