CVE-2019-10934

highPriorität · verfolgen · 31EPSS 0.004 · 37. PerzentilDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.43% (37th) EPSS
CVSS 7.2 · high
Is it mine?
20 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

A vulnerability has been identified in TIA Portal V14 (All versions), TIA Portal V15 (All versions < V15.1 Update 7), TIA Portal V16 (All versions < V16 Update 6), TIA Portal V17 (All versions < V17 Update 4). Changing the contents of a configuration file could allow an attacker to execute arbitrary code with SYSTEM privileges. The security vulnerability could be exploited by an attacker with a valid account and limited access rights on the system. No user interaction is required. At the time of advisory publication no public exploitation of this security vulnerability was known.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenTIA Portal V15siemens_psirt

    Update to V15.1 Update 7 or later version

    https://support.industry.siemens.com/cs/de/de/view/109763890/
  • BehobenTIA Portal V16siemens_psirt

    Update to V16 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109775861/
  • BehobenTIA Portal V17siemens_psirt

    Update to V17 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784441/
  • BehobenTIA Portal V15cisa_csaf_ot

    TIA Portal v15: Update to v15.1 Update 7 or later

    https://support.industry.siemens.com/cs/de/de/view/109763890
  • BehobenTIA Portal V16cisa_csaf_ot

    TIA Portal v16: Update to v16 Update 6 or later

    https://support.industry.siemens.com/cs/ww/en/view/109775861/
  • BehobenTIA Portal V17cisa_csaf_ot

    TIA Portal v17: Update to v17 Update 4 or later

    https://support.industry.siemens.com/cs/ww/en/view/109784441
  • MitigationTIA Portal V14siemens_psirt

    Remove write permissions for every non-administrative user on files and folders located below the "TraceEngine" folder (usually located at "C:\ProgramData\Siemens\Automation")

  • MitigationTIA Portal V15siemens_psirt

    Remove write permissions for every non-administrative user on files and folders located below the "TraceEngine" folder (usually located at "C:\ProgramData\Siemens\Automation")

  • MitigationTIA Portal V16siemens_psirt

    Remove write permissions for every non-administrative user on files and folders located below the "TraceEngine" folder (usually located at "C:\ProgramData\Siemens\Automation")

  • MitigationTIA Portal V17siemens_psirt

    Remove write permissions for every non-administrative user on files and folders located below the "TraceEngine" folder (usually located at "C:\ProgramData\Siemens\Automation")

  • MitigationTIA Portal V14cisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk: A partially working fix for Native Language Windows Versions in English or Multilingual User Interface (MUI) Windows Installation was included in TIA Portal Versions v14 SP1 Update 10, v15 SP1 Update 4, v16 Update 1, and v17.

    http://www.siemens.com/cert/advisories
  • MitigationTIA Portal V15cisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk: A partially working fix for Native Language Windows Versions in English or Multilingual User Interface (MUI) Windows Installation was included in TIA Portal Versions v14 SP1 Update 10, v15 SP1 Update 4, v16 Update 1, and v17.

    http://www.siemens.com/cert/advisories
  • MitigationTIA Portal V16cisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk: A partially working fix for Native Language Windows Versions in English or Multilingual User Interface (MUI) Windows Installation was included in TIA Portal Versions v14 SP1 Update 10, v15 SP1 Update 4, v16 Update 1, and v17.

    http://www.siemens.com/cert/advisories
  • MitigationTIA Portal V17cisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk: A partially working fix for Native Language Windows Versions in English or Multilingual User Interface (MUI) Windows Installation was included in TIA Portal Versions v14 SP1 Update 10, v15 SP1 Update 4, v16 Update 1, and v17.

    http://www.siemens.com/cert/advisories
  • WorkaroundTIA Portal V14siemens_psirt

    A partially working fix for Native Language Windows Versions in English or Multilingual User Interface (MUI) Windows Installation was included in TIA Portal Versions V14 SP1 Update 10, V15 SP1 Update 4,V16 Update 1 and V17

  • WorkaroundTIA Portal V15siemens_psirt

    A partially working fix for Native Language Windows Versions in English or Multilingual User Interface (MUI) Windows Installation was included in TIA Portal Versions V14 SP1 Update 10, V15 SP1 Update 4,V16 Update 1 and V17

  • WorkaroundTIA Portal V16siemens_psirt

    A partially working fix for Native Language Windows Versions in English or Multilingual User Interface (MUI) Windows Installation was included in TIA Portal Versions V14 SP1 Update 10, V15 SP1 Update 4,V16 Update 1 and V17

  • WorkaroundTIA Portal V17siemens_psirt

    A partially working fix for Native Language Windows Versions in English or Multilingual User Interface (MUI) Windows Installation was included in TIA Portal Versions V14 SP1 Update 10, V15 SP1 Update 4,V16 Update 1 and V17

  • Kein Fix geplantTIA Portal V14siemens_psirt

    Currently no fix is planned

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 10
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9
v3.07.8highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:Csecondary · Siemens ProductCERT DE
v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-22USCWE-22USCWE-22USCWE-22US
04

betroffene Produkte (20)

Betroffene Produkte und Versionsbereiche.

05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • SSA-629512SSA-629512: Local Privilege Escalation Vulnerability in TIA Portal2020-01-14csaf · siemens_psirtDE

    The latest updates for TIA Portal fix a vulnerability that could allow a local attacker to execute arbitrary code with SYSTEM privileges. Update: The previously provided fixes only correctly set the permissions on English Windows versions. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • ICSA-20-014-05Siemens TIA Portal (Update F)2020-01-16icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow a local attacker to execute arbitrary code with SYSTEM privileges.

06

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2020-01-16geändert 2026-06-17
08

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan