#VU20349 Insufficient Resource Pool


Published: 2019-08-21

Vulnerability identifier: #VU20349

Vulnerability risk: Medium

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2019-10942

CWE-ID: N/A

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
SCALANCE X-200RNA
Hardware solutions / Routers & switches, VoIP, GSM, etc
SCALANCE X-200 IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc
SCALANCE X-200
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: Siemens

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the device's resource pool is not large enough to handle peak demand. A remote attacker can send large message packages repeatedly to the telnet service and cause a denial of service condition.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

SCALANCE X-200RNA: All versions

SCALANCE X-200 IRT: All versions

SCALANCE X-200: All versions

External links
http://cert-portal.siemens.com/productcert/pdf/ssa-100232.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Denial of service in Siemens SCALANCE X Switches