Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-13942

A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module IEC104 variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). An unauthorized user could exploit a buffer overflow vulnerability in the webserver. Specially crafted packets sent could cause a Denial-of-Service condition and if certain conditions are met, the affected devices must be restarted manually to fully recover. At the time of advisory publication no public exploitation of this security vulnerability was known.

Published

2019-12-12T19:15:14.997

Last Modified

2024-11-21T04:25:44.567

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-119
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System siemens en100_ethernet_module_with_firmware_variant_dnp3_tcp * Yes
Operating System siemens en100_ethernet_module_with_firmware_variant_iec_61850 < 4.37 Yes
Operating System siemens en100_ethernet_module_with_firmware_variant_iec104 * Yes
Operating System siemens en100_ethernet_module_with_firmware_variant_modbus_tcp * Yes
Operating System siemens en100_ethernet_module_with_firmware_variant_profinet_io * Yes
Hardware siemens en100_ethernet_module - No
References