Resource exhaustion in Siemens products - CVE-2019-13946

Vulnerability identifier: #VU25270

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-13946

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the Profinet-IO (PNIO) stack versions prior v06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

SIMATIC ET200SP IM155-6 PN ST
SIMATIC ET200AL IM 157-1 PN
SIMATIC ET200M IM153-4 PN IO HF
SIMATIC ET200M IM153-4 PN IO ST
SIMATIC ET200MP IM155-5 PN HF
SIMATIC ET200MP IM155-5 PN ST
SIMATIC ET 200S
SIMATIC ET200SP IM155-6 PN Basic
SIMATIC ET200SP IM155-6 PN HF
SIMATIC ET 200ecoPN
SIMATIC PN/PN Coupler 6ES7158-3AD01-0XA0
SINAMICS DCP
SCALANCE M-800 / S615
SCALANCE W-700 (IEEE 802.11n)
Development/Evaluation Kits for PROFINET IO
SIMATIC CP 343-1 ERPC
SIMATIC CP 343-1 LEAN
SIMATIC CP 443-1 Standard
SIMATIC CP443-1 OPC UA
SIMATIC CP 443-1 Advanced
SIMATIC RF600
SIMATIC CP 343-1 Advanced
SIMATIC CP 343-1 Standard
SIMATIC ET200pro IM 154-3 PN HF
SIMATIC ET200pro IM 154-4 PN HF
SIMATIC RF182C
SIMATIC RF180C
SCALANCE XF-200BA
RUGGEDCOM RM1224
SCALANCE X-200
SCALANCE X-200 IRT
SCALANCE X-300
SCALANCE XB-200
SCALANCE XC-200
SCALANCE XP-200
SCALANCE XR-300WG
SCALANCE XM-400
SCALANCE XR-500
SIMATIC CP 1616
SIMATIC CP 1604
SIMATIC IPC Support, Package for VxWorks
SIMATIC MV400
SIMATIC PROFINET Driver

• Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200: Update to v4.5 Patch 01 
• Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P: Update to v4.6 
• PROFINET Driver for Controller: Update to v2.1 Patch 03
• SCALANCE M-800 / S615: Update to v6.1.2
• SCALANCE W700 IEEE 802.11n: Update to v6.4
• SCALANCE X-200IRT switch family: Update to v5.4.2
• SCALANCE XB-200, XC-200, XP-200, XF-200BA and XR-300WG: Update to v4.1
• SCALANCE XM-400 switch family: Update to v6.2.3
• SCALANCE XR-500 switch family: Update to v6.2.3
• SIMATIC CP 1616 and CP 1604: Update to v2.8.1
• SIMATIC ET200MP IM155-5 PN HF: Update to v4.2.0
• SIMATIC ET200MP IM155-5 PN ST: Update to v4.1.0
• SIMATIC ET200SP IM155-6 PN HF: Update to v4.2.2
• SIMATIC ET200SP IM155-6 PN ST: pdate to v4.1.0
• SIMATIC RF600 family: Update to v3.2.1
• SINAMICS DCP: Update to v1.3

SIMATIC ET200SP IM155-6 PN ST - update to 4.1.0
SIMATIC ET200MP IM155-5 PN HF - update to 4.2.0
SIMATIC ET200MP IM155-5 PN ST - update to 4.1.0
SIMATIC ET200SP IM155-6 PN HF - update to 3.3.1
SIMATIC RF600 - update to 3
SINAMICS DCP - update to 1.3
SCALANCE XF-200BA - update to 3.0
SIMATIC PROFINET Driver - update to 2.1
RUGGEDCOM RM1224 - update to 4.3
SCALANCE M-800 / S615 - update to 4.3
SCALANCE W-700 (IEEE 802.11n) - update to 6.0.1
SCALANCE X-200 IRT - update to 5.3.0
SCALANCE XB-200 - update to 3.0
SCALANCE XC-200 - update to 3.0
SCALANCE XP-200 - update to 3.0
Development/Evaluation Kits for PROFINET IO - addressed in versions 4.5, 4.6
SCALANCE XR-300WG - update to 3.0
SCALANCE XM-400 - update to 6.0
SCALANCE XR-500 - update to 6.0
SIMATIC CP 1616 - update to 2.8
SIMATIC CP 1604 - update to 2.8

• https://cert-portal.siemens.com/productcert/pdf/ssa-780073.pdf

• Denial of service in Siemens PROFINET-IO Stack