CVE-2019-6568 vulnerability in Siemens Products
Published on April 17, 2019

The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation which leads to a restart of the webserver of the affected device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device.

NVD

Weakness Type

Out-of-bounds Read

The software reads data past the end, or before the beginning, of the intended buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. A crash can occur when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent read operation then produces undefined or unexpected results.

Products Associated with CVE-2019-6568

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2019-6568 are published in these products:

Siemens Simatic Cp443 1 Opc Ua

Siemens Simatic Ipc Diagmonitor

Siemens Simatic S7 1500 Software Controller

Siemens Simatic S7 Plcsim Advanced

Siemens Simatic Wincc Runtime Advanced

Siemens Sitop Manager

Affected Versions

Siemens SIMATIC CP 1604:

Version All versions is affected.

Siemens SIMATIC CP 1616:

Version All versions is affected.

Siemens SIMATIC CP 343-1 Advanced:

Version All versions is affected.

Siemens SIMATIC CP 443-1:

Version All versions < V3.3 is affected.

Siemens SIMATIC CP 443-1:

Version All versions < V3.3 is affected.

Siemens SIMATIC CP 443-1 Advanced:

Version All versions < V3.3 is affected.

Siemens SIMATIC CP 443-1 OPC UA:

Version All versions is affected.

Siemens SIMATIC ET 200pro IM154-8 PN/DP CPU:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC ET 200pro IM154-8F PN/DP CPU:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC ET 200pro IM154-8FX PN/DP CPU:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC ET 200S IM151-8 PN/DP CPU:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC ET 200S IM151-8F PN/DP CPU:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants):

Version All versions < V2.1.6 is affected.

Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants):

Version All versions < V2.7 is affected.

Siemens SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants):

Version All versions < V15.1 Upd4 is affected.

Siemens SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants):

Version All versions < V15.1 Upd4 is affected.

Siemens SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F:

Version All versions < V15.1 Upd4 is affected.

Siemens SIMATIC IPC DiagMonitor:

Version All versions < V5.1.3 is affected.

Siemens SIMATIC RF182C:

Version All versions is affected.

Siemens SIMATIC RF185C:

Version All versions < V1.1.0 is affected.

Siemens SIMATIC RF186C:

Version All versions < V1.1.0 is affected.

Siemens SIMATIC RF188C:

Version All versions < V1.1.0 is affected.

Siemens SIMATIC RF600R family:

Version All versions < V3.2.1 is affected.

Siemens SIMATIC RFID 181EIP:

Version All versions is affected.

Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants):

Version All versions < V2.6.1 is affected.

Siemens SIMATIC S7-1500 Software Controller:

Version All versions < V2.7 is affected.

Siemens SIMATIC S7-300 CPU 314C-2 PN/DP:

Version All versions < V3.3.16 is affected.

Siemens SIMATIC S7-300 CPU 315-2 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-300 CPU 315F-2 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-300 CPU 315T-3 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-300 CPU 317-2 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-300 CPU 317F-2 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-300 CPU 317T-3 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-300 CPU 319-3 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-300 CPU 319F-3 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants):

Version All versions is affected.

Siemens SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants):

Version All versions is affected.

Siemens SIMATIC S7-PLCSIM Advanced:

Version All versions < V2.0 SP1 UPD1 is affected.

Siemens SIMATIC Teleservice Adapter IE Advanced:

Version All versions is affected.

Siemens SIMATIC Teleservice Adapter IE Basic:

Version All versions is affected.

Siemens SIMATIC Teleservice Adapter IE Standard:

Version All versions is affected.

Siemens SIMATIC WinAC RTX 2010:

Version All versions < V2010 SP3 is affected.

Siemens SIMATIC WinAC RTX F 2010:

Version All versions < V2010 SP3 is affected.

Siemens SIMATIC WinCC Runtime Advanced:

Version All versions < V15.1 Upd4 is affected.

Siemens SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants):

Version All versions < V1.1.3 is affected.

Siemens SIMOCODE pro V PROFINET (incl. SIPLUS variants):

Version All versions < V2.1.3 is affected.

Siemens SINAMICS G130 V4.6 Control Unit:

Version All versions is affected.

Siemens SINAMICS G130 V4.7 Control Unit:

Version All versions is affected.

Siemens SINAMICS G130 V4.7 SP1 Control Unit:

Version All versions is affected.

Siemens SINAMICS G130 V4.8 Control Unit:

Version All versions < V4.8 HF6 is affected.

Siemens SINAMICS G130 V5.1 Control Unit:

Version All versions is affected.

Siemens SINAMICS G130 V5.1 SP1 Control Unit:

Version All versions < V5.1 SP1 HF4 is affected.

Siemens SINAMICS G150 V4.6 Control Unit:

Version All versions is affected.

Siemens SINAMICS G150 V4.7 Control Unit:

Version All versions is affected.

Siemens SINAMICS G150 V4.7 SP1 Control Unit:

Version All versions is affected.

Siemens SINAMICS G150 V4.8 Control Unit:

Version All versions < V4.8 HF6 is affected.

Siemens SINAMICS G150 V5.1 Control Unit:

Version All versions is affected.

Siemens SINAMICS G150 V5.1 SP1 Control Unit:

Version All versions < V5.1 SP1 HF4 is affected.

Siemens SINAMICS GH150 V4.7 (Control Unit):

Version All versions is affected.

Siemens SINAMICS GH150 V4.8 (Control Unit):

Version All versions < V4.8 SP2 HF9 is affected.

Siemens SINAMICS GL150 V4.7 (Control Unit):

Version All versions is affected.

Siemens SINAMICS GL150 V4.8 (Control Unit):

Version All versions < V4.8 SP2 HF9 is affected.

Siemens SINAMICS GM150 V4.7 (Control Unit):

Version All versions is affected.

Siemens SINAMICS GM150 V4.8 (Control Unit):

Version All versions < V4.8 SP2 HF9 is affected.

Siemens SINAMICS S120 V4.6 Control Unit (incl. SIPLUS variants):

Version All versions is affected.

Siemens SINAMICS S120 V4.7 Control Unit (incl. SIPLUS variants):

Version All versions is affected.

Siemens SINAMICS S120 V4.7 SP1 Control Unit (incl. SIPLUS variants):

Version All versions is affected.

Siemens SINAMICS S120 V4.8 Control Unit (incl. SIPLUS variants):

Version All versions < V4.8 HF6 is affected.

Siemens SINAMICS S120 V5.1 Control Unit (incl. SIPLUS variants):

Version All versions is affected.

Siemens SINAMICS S120 V5.1 SP1 Control Unit (incl. SIPLUS variants):

Version All versions < V5.1 SP1 HF4 is affected.

Siemens SINAMICS S150 V4.6 Control Unit:

Version All versions is affected.

Siemens SINAMICS S150 V4.7 Control Unit:

Version All versions is affected.

Siemens SINAMICS S150 V4.7 SP1 Control Unit:

Version All versions is affected.

Siemens SINAMICS S150 V4.8 Control Unit:

Version All versions < V4.8 HF6 is affected.

Siemens SINAMICS S150 V5.1 Control Unit:

Version All versions is affected.

Siemens SINAMICS S150 V5.1 SP1 Control Unit:

Version All versions < V5.1 SP1 HF4 is affected.

Siemens SINAMICS S210:

Version All versions < V5.1 SP1 HF8 is affected.

Siemens SINAMICS SL150 V4.7 (Control Unit):

Version All versions < V4.7 HF33 is affected.

Siemens SINAMICS SL150 V4.8 (Control Unit):

Version All versions is affected.

Siemens SINAMICS SM120 V4.7 (Control Unit):

Version All versions is affected.

Siemens SINAMICS SM120 V4.8 (Control Unit):

Version All versions < V4.8 SP2 HF10 is affected.

Siemens SINAMICS SM150 V4.8 (Control Unit):

Version All versions is affected.

Siemens SIPLUS ET 200S IM151-8 PN/DP CPU:

Version All versions < V3.2.16 is affected.

Siemens SIPLUS ET 200S IM151-8F PN/DP CPU:

Version All versions < V3.2.16 is affected.

Siemens SIPLUS NET CP 343-1 Advanced:

Version All versions is affected.

Siemens SIPLUS NET CP 443-1:

Version All versions < V3.3 is affected.

Siemens SIPLUS NET CP 443-1 Advanced:

Version All versions < V3.3 is affected.

Siemens SIPLUS S7-300 CPU 314C-2 PN/DP:

Version All versions < V3.3.16 is affected.

Siemens SIPLUS S7-300 CPU 315-2 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIPLUS S7-300 CPU 315F-2 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIPLUS S7-300 CPU 317-2 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SIPLUS S7-300 CPU 317F-2 PN/DP:

Version All versions < V3.2.16 is affected.

Siemens SITOP Manager:

Version All versions < V1.1 is affected.

Siemens SITOP PSU8600:

Version All versions < V1.5 is affected.

Siemens SITOP UPS1600 (incl. SIPLUS variants):

Version All versions < V2.3 is affected.

Siemens TIM 1531 IRC (incl. SIPLUS NET variants):

Version All versions < V2.1 is affected.

Exploit Probability

EPSS

0.41%

Percentile

60.69%