Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
0

CVE-2019-13940

Disclosure Date: February 11, 2020 •
CVE-2019-13940 CVSS v3 Base Score: 7.5
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A vulnerability has been identified in SIMATIC ET 200pro IM154-8 PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8F PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8FX PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200S IM151-8 PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200S IM151-8F PN/DP CPU (All versions < V3.X.17), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.1), SIMATIC S7-300 CPU 314C-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 315-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 315F-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 315T-3 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 317-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 317F-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 317T-3 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 317TF-3 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 319-3 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 319F-3 PN/DP (All versions < V3.X.17), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC WinAC RTX 2010 (All versions), SIMATIC WinAC RTX F 2010 (All versions), SIPLUS ET 200S IM151-8 PN/DP CPU (All versions < V3.X.17), SIPLUS ET 200S IM151-8F PN/DP CPU (All versions < V3.X.17), SIPLUS S7-300 CPU 314C-2 PN/DP (All versions < V3.X.17), SIPLUS S7-300 CPU 315-2 PN/DP (All versions < V3.X.17), SIPLUS S7-300 CPU 315F-2 PN/DP (All versions < V3.X.17), SIPLUS S7-300 CPU 317-2 PN/DP (All versions < V3.X.17), SIPLUS S7-300 CPU 317F-2 PN/DP (All versions < V3.X.17). Affected devices contain a vulnerability that could cause a denial of service condition of the web server
by sending specially crafted HTTP requests to ports 80/tcp and 443/tcp.

Beyond the web service, no other functions or interfaces are affected by the denial of service condition.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
SIMATIC ET 200pro IM154-8 PN/DP CPU All versions < V3.X.17
SIMATIC ET 200pro IM154-8F PN/DP CPU All versions < V3.X.17
SIMATIC ET 200pro IM154-8FX PN/DP CPU All versions < V3.X.17
SIMATIC ET 200S IM151-8 PN/DP CPU All versions < V3.X.17
SIMATIC ET 200S IM151-8F PN/DP CPU All versions < V3.X.17
SIMATIC S7-1200 CPU family (incl. SIPLUS variants) All versions < V4.1
SIMATIC S7-300 CPU 314C-2 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 315-2 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 315F-2 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 315T-3 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 317-2 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 317F-2 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 317T-3 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 317TF-3 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 319-3 PN/DP All versions < V3.X.17
SIMATIC S7-300 CPU 319F-3 PN/DP All versions < V3.X.17
SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) All versions
SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) All versions
SIMATIC WinAC RTX 2010 All versions
SIMATIC WinAC RTX F 2010 All versions
SIPLUS ET 200S IM151-8 PN/DP CPU All versions < V3.X.17
SIPLUS ET 200S IM151-8F PN/DP CPU All versions < V3.X.17
SIPLUS S7-300 CPU 314C-2 PN/DP All versions < V3.X.17
SIPLUS S7-300 CPU 315-2 PN/DP All versions < V3.X.17
SIPLUS S7-300 CPU 315F-2 PN/DP All versions < V3.X.17
SIPLUS S7-300 CPU 317-2 PN/DP All versions < V3.X.17
SIPLUS S7-300 CPU 317F-2 PN/DP All versions < V3.X.17
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis