CVE-2019-10943

mediumPriorität · verfolgen · 30OT-Risiko · erhöhtEPSS 0.010 · 61. PerzentilDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.95% (61st) EPSS
CVSS 5 · medium
Is it mine?
62 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · siemens_psirt

EPSS · bewertet 2026-10-27

A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V20.8), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.4.0), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.4.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.8.1), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.8.1), SIMATIC S7-1500 Software Controller (All versions < V20.8), SIMATIC S7-1500 Software Controller (All versions >= V20.8), SIMATIC S7-PLCSIM Advanced (All versions < V3.0), SIMATIC S7-PLCSIM Advanced (All versions >= V3.0). An attacker with network access to port 102/tcp could potentially modify the user program on the PLC in a way that the running code is different from the source code which is stored on the device. An attacker must have network access to affected devices and must be able to perform changes to the user program. The vulnerability could impact the perceived integrity of the user program stored on the CPU. An engineer that tries to obtain the code of the user program running on the device, can receive different source code that is not actually running on the device.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Update to V4.4.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • BehobenSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Update to V2.8.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • BehobenSIMATIC S7-1500 Software Controllersiemens_psirt

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772864/
  • BehobenSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772889/
  • BehobenSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)cisa_csaf_ot

    SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update to v20.8

    https://support.industry.siemens.com/cs/document/109759122/
  • BehobenSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot

    SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update to v20.8

    https://support.industry.siemens.com/cs/document/109759122/
  • BehobenSIMATIC ET200SP (incl. SIPLUS variants) Open Controller CPU 1515SP PCcisa_csaf_ot

    SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update to v20.8

    https://support.industry.siemens.com/cs/document/109759122/
  • BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot

    SIMATIC S7-1200 CPU family: Update to v4.4.0

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • BehobenSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot

    SIMATIC S7-1500 CPU family: Update to v2.8.1

    https://support.industry.siemens.com/cs/document/109478459/
  • BehobenSIMATIC S7-1500 Software Controllercisa_csaf_ot

    SIMATIC S7-1500 Software Controller: Update to v20.8

    https://support.industry.siemens.com/cs/document/109772864/
  • BehobenSIMATIC S7-PLCSIM Advancedcisa_csaf_ot

    SIMATIC S7 PLCSIM Advanced: Update to v3.0

    https://support.industry.siemens.com/cs/document/109772889/
  • MitigationSIMATIC Drive Controller familysiemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)siemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 Software Controllersiemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC Drive Controller familycisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)cisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC ET200SP (incl. SIPLUS variants) Open Controller CPU 1515SP PCcisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC S7-1500 Software Controllercisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC S7-PLCSIM Advancedcisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • Kein Fix geplantSIMATIC Drive Controller familysiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • Kein Fix geplantSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-1500 Software Controllersiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Currently no fix is planned

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · CISA US
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:T/RC:Csecondary · Siemens ProductCERT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-345USCWE-353USCWE-353USCWE-353US
04

betroffene Produkte (62)

Betroffene Produkte und Versionsbereiche.

20 von 62 angezeigt
05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • SSA-232418SSA-232418: Vulnerabilities in SIMATIC S7-1200 and SIMATIC S7-1500 CPU Families2019-08-13csaf · siemens_psirtDE

    Two vulnerabilities have been identified in the SIMATIC S7-1200/S7-1500 CPU families and related products. One vulnerability (CVE-2019-10943) could allow an attacker with network access to affected devices to modify the user program stored on these devices such that the source code differs from the actual running code. The other vulnerability (CVE-2019-10929) could allow an attacker in a Man- in-the-Middle position to modify network traffic exchanged on port 102/tcp. Siemens has released updates for several affected products to fix CVE-2019-10929 and recommends to update to the latest versions. Regarding CVE-2019-10943, Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • ICSA-19-344-06Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update B)2019-12-10icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities may allow an attacker to modify network traffic or impact the perceived integrity of the user program stored on the CPU.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2019-08-13geändert 2026-06-17
08

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan