CVE-2019-13921 (GCVE-0-2019-13921)
Vulnerability from cvelistv5
Published
2019-10-10 13:49
Modified
2024-08-05 00:05
Severity ?
CWE
  • CWE-410 - Insufficient Resource Pool
Summary
A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software.
References
Impacted products
Vendor Product Version
Siemens AG SIMATIC WinAC RTX (F) 2010 Version: All versions < SP3 Update 1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:05:44.060Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SIMATIC WinAC RTX (F) 2010",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c SP3 Update 1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions \u003c SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-410",
              "description": "CWE-410: Insufficient Resource Pool",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-16T15:35:24",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2019-13921",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SIMATIC WinAC RTX (F) 2010",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c SP3 Update 1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens AG"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions \u003c SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-410: Insufficient Resource Pool"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf",
              "refsource": "MISC",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2019-13921",
    "datePublished": "2019-10-10T13:49:24",
    "dateReserved": "2019-07-18T00:00:00",
    "dateUpdated": "2024-08-05T00:05:44.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-13921\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2019-10-10T14:15:14.783\",\"lastModified\":\"2024-11-21T04:25:42.200\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions \u003c SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en SIMATIC WinAC RTX (F) 2010 (Todas las versiones anteriores a SP3 Actualizaci\u00f3n 1). Las versiones afectadas del software contienen una vulnerabilidad que podr\u00eda permitir a un atacante no autenticado desencadenar una condici\u00f3n de denegaci\u00f3n de servicio. La vulnerabilidad puede ser desencadenada si se env\u00eda una petici\u00f3n HTTP grande hacia el servicio en ejecuci\u00f3n. La vulnerabilidad de seguridad podr\u00eda ser explotada por parte de un atacante con acceso de red en los sistemas afectados. La explotaci\u00f3n con \u00e9xito no requiere privilegios de sistema ni interacci\u00f3n del usuario. Un atacante podr\u00eda usar la vulnerabilidad para comprometer la disponibilidad del servicio proporcionado por el software.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-410\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5537D556-046A-444A-9AB6-B4F9AA121CF1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06718100-6BF9-43F7-9A7E-81CB6DCE3EF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:-:update_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EC44EDB-7E3D-4859-B915-CB0C5770ED93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:-:update_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A5A9149-3AE7-41E2-B246-ECBDA62C2717\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:-:update_3:*:*:*:*:*:*\",\"matchCriteriaId\":\"8506204D-BB1E-4436-B973-C156B8F0BBFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:sp1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D6BBAA3-EF06-4B49-B69D-73549FDAA33C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:sp2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE395DFC-C34F-4A05-88C1-7EE643584D1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:sp2:update_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BA70649-12F3-4A96-8701-47C5E00D0CC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:sp2:update_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"67910EB2-1B62-4AF3-AE7E-BF46B564E4D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:sp2:update_3:*:*:*:*:*:*\",\"matchCriteriaId\":\"63AB302F-D0AB-4B65-AA99-BE3CFA25BADC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_winac_rtx_\\\\(f\\\\)_2010:sp2:update_4:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B01088F-6BF5-4904-9C61-7AAAFC4A762F\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.