High severity · published Jul 11, 2019
CVE-2019-10915
A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1)
7.8
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration web application (TIA Administrator) allows to execute certain application commands without proper authentication. The vulnerability could be exploited by an attacker with local access to the affected system. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Sinetplan · Siemens
2.0 · source: NVD
TA
Tia Administrator · Siemens
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10915
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10915
Third Party Advisory
http://www.securityfocus.com/bid/109124
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-721298.pdf
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-834884.pdf
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-253-02
More from Sinetplan
7.5
CVE-2022-27194
A vulnerability has been identified in SIMATIC PCS neo (Administration Console) (All versions < V3.1 SP1), SINETPLAN (All versions), TIA Portal (V15, V15.1, V16 and V17)
