CVE-2019-10943

mediumpriority · track · 30OT risk · elevatedEPSS 0.010 · 61 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.95% (61st) EPSS
CVSS 5 · medium
Is it mine?
62 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · siemens_psirt

EPSS · scored 2026-10-27

A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V20.8), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.4.0), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.4.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.8.1), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.8.1), SIMATIC S7-1500 Software Controller (All versions < V20.8), SIMATIC S7-1500 Software Controller (All versions >= V20.8), SIMATIC S7-PLCSIM Advanced (All versions < V3.0), SIMATIC S7-PLCSIM Advanced (All versions >= V3.0). An attacker with network access to port 102/tcp could potentially modify the user program on the PLC in a way that the running code is different from the source code which is stored on the device. An attacker must have network access to affected devices and must be able to perform changes to the user program. The vulnerability could impact the perceived integrity of the user program stored on the CPU. An engineer that tries to obtain the code of the user program running on the device, can receive different source code that is not actually running on the device.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Update to V4.4.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Update to V2.8.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 Software Controllersiemens_psirt

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772864/
  • FixedSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772889/
  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)cisa_csaf_ot

    SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update to v20.8

    https://support.industry.siemens.com/cs/document/109759122/
  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot

    SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update to v20.8

    https://support.industry.siemens.com/cs/document/109759122/
  • FixedSIMATIC ET200SP (incl. SIPLUS variants) Open Controller CPU 1515SP PCcisa_csaf_ot

    SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update to v20.8

    https://support.industry.siemens.com/cs/document/109759122/
  • FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot

    SIMATIC S7-1200 CPU family: Update to v4.4.0

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot

    SIMATIC S7-1500 CPU family: Update to v2.8.1

    https://support.industry.siemens.com/cs/document/109478459/
  • FixedSIMATIC S7-1500 Software Controllercisa_csaf_ot

    SIMATIC S7-1500 Software Controller: Update to v20.8

    https://support.industry.siemens.com/cs/document/109772864/
  • FixedSIMATIC S7-PLCSIM Advancedcisa_csaf_ot

    SIMATIC S7 PLCSIM Advanced: Update to v3.0

    https://support.industry.siemens.com/cs/document/109772889/
  • MitigationSIMATIC Drive Controller familysiemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)siemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 Software Controllersiemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Apply password protection for S7 communication

  • MitigationSIMATIC Drive Controller familycisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)cisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC ET200SP (incl. SIPLUS variants) Open Controller CPU 1515SP PCcisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC S7-1500 Software Controllercisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • MitigationSIMATIC S7-PLCSIM Advancedcisa_csaf_ot

    All affected devices contain a feature called “Access Protection” that prohibits unauthorized modifications of user code. Siemens recommends using access protection to protect affected devices from unauthorized modifications.

  • No fix plannedSIMATIC Drive Controller familysiemens_psirt

    Currently no fix is planned

  • No fix plannedSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • No fix plannedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • No fix plannedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • No fix plannedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt

    Currently no fix is planned

  • No fix plannedSIMATIC S7-1500 Software Controllersiemens_psirt

    Currently no fix is planned

  • No fix plannedSIMATIC S7-PLCSIM Advancedsiemens_psirt

    Currently no fix is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · CISA US
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:T/RC:Csecondary · Siemens ProductCERT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-345USCWE-353USCWE-353USCWE-353US
04

affected products (62)

Products and version ranges known to be affected.

showing 20 of 62
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • SSA-232418SSA-232418: Vulnerabilities in SIMATIC S7-1200 and SIMATIC S7-1500 CPU Families2019-08-13csaf · siemens_psirtDE

    Two vulnerabilities have been identified in the SIMATIC S7-1200/S7-1500 CPU families and related products. One vulnerability (CVE-2019-10943) could allow an attacker with network access to affected devices to modify the user program stored on these devices such that the source code differs from the actual running code. The other vulnerability (CVE-2019-10929) could allow an attacker in a Man- in-the-Middle position to modify network traffic exchanged on port 102/tcp. Siemens has released updates for several affected products to fix CVE-2019-10929 and recommends to update to the latest versions. Regarding CVE-2019-10943, Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • ICSA-19-344-06Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update B)2019-12-10icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities may allow an attacker to modify network traffic or impact the perceived integrity of the user program stored on the CPU.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otsiemens_psirtNVDCVE.orgMITRE
published 2019-08-13modified 2026-06-17
08

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan