CVE-2019-3823
mediumpriority · track · 31EPSS 0.041 · 91 %ileDEEURUUSEPSS · scored 2026-10-22
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSCALANCE SC600 Familysiemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109769665/ - FixedSIMATIC CM 1542-1siemens_psirt
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109801629/ - FixedSINEMA Remote Connect Clientcisa_csaf_ot
Turn off NTLM authentication to mitigate CVE-2018-16890 and CVE-2019-3822
- FixedSINEMA Remote Connect Servercisa_csaf_ot
Turn off NTLM authentication to mitigate CVE-2018-16890 and CVE-2019-3822
- FixedSINEMA Remote Connect Clientcisa_csaf_ot
Update to V2.0 HF1
- MitigationSCALANCE SC600 Familysiemens_psirt
Disable the SMTP Client function on affected devices or use VPN for protecting SMTP traffic to trusted email servers only
- MitigationSIMATIC CM 1542-1siemens_psirt
Disable the SMTP Client function on affected devices or use VPN for protecting SMTP traffic to trusted email servers only
- MitigationSIMATIC CP 343-1 Advanced (incl. SIPLUS variants)siemens_psirt
Disable the SMTP Client function on affected devices or use VPN for protecting SMTP traffic to trusted email servers only
- MitigationSINEMA Remote Connect Clientcisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSINEMA Remote Connect Servercisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSINEMA Remote Connect Clientcisa_csaf_ot
Turn off SMTP to mitigate CVE-2019-3823
- No fix availableSIMATIC CP 343-1 Advanced (incl. SIPLUS variants)siemens_psirt
Currently no remediation is available
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 4.3–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (33)
Products and version ranges known to be affected.
advisories (7)
Vendor and ecosystem advisories describing this.
- SSA-936080SSA-936080: Multiple Vulnerabilities in Third-Party Component libcurl2021-03-09csaf · siemens_psirtDE
SIMATIC CM 1542-1, SCALANCE SC600 family and SIMATIC CP 343-1 Advanced devices are vulnerable to a vulnerability in the third party component libcurl that could allow an attacker to cause a Denial-of-Service condition on the affected devices. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. The impact of additional libcurl vulnerabilities is described in Siemens Security Advisory SSA-436177.
- WID-SEC-W-2023-1640cURL: Mehrere SchwachstellenDeutsch2019-02-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Informationen offenzulegen oder einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2025-1212Oracle Communications Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
- WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
- ICSA-19-099-04Siemens SINEMA Remote Connect (Update A)2019-04-09icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to circumvent the system authorization for certain functionalities, and to execute privileged functions.
- ICSA-21-068-10Siemens SCALANCE and SIMATIC libcurl (Update B)2019-04-09icsa · cisa_csaf_otUS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
- CURL-CVE-2019-3823SMTP end-of-response out-of-bounds read2019-02-06vendor · osvUS
libcurl contains a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` is not null-terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read content is not returned to the caller.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (61)
External citations — patches, advisories, analysis.
- http://curl.haxx.se/cnnvd
- http://www.ibm.com/support/docview.wsscnnvd
- http://www.securityfocus.com/bid/106950cnnvd
- https://access.redhat.com/errata/RHSA-2019:3701cnnvd
- https://access.redhat.com/security/cve/cve-2019-3822cnnvd
- https://access.redhat.com/security/cve/cve-2019-3823cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan