CVE-2019-10930 : What You Need to Know

A weakness has been found in various models of SIPROTEC 5 devices, DIGSI 5 engineering software, and specific SIPROTEC 5 device types with CPU variants CP300 and CP100, making them vulnerable to exploitation by unauthorized remote individuals.

Understanding CVE-2019-10930

This CVE identifies a vulnerability in Siemens AG products, allowing attackers to manipulate files within the file system through specially crafted packets.

What is CVE-2019-10930?

The vulnerability affects multiple SIPROTEC 5 device models, DIGSI 5 software, and specific SIPROTEC 5 device types with CPU variants CP300 and CP100, enabling unauthorized remote manipulation of files.

The Impact of CVE-2019-10930

Unauthorized remote attackers could exploit the vulnerability by sending crafted packets to port 443/TCP, potentially uploading, downloading, or deleting files within certain sections of the file system.

Technical Details of CVE-2019-10930

Siemens AG products are affected by this vulnerability, including specific versions and device types.

Vulnerability Description

The vulnerability allows remote attackers to manipulate files within the file system of affected Siemens AG products.

Affected Systems and Versions

All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions)
DIGSI 5 engineering software (All versions < V7.90)
SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, and more with CPU variants CP300 and CP100 (All versions < V7.90)
SIPROTEC 5 device types 7SS85 and 7KE85 (All versions < V8.01)
SIPROTEC 5 device types with CPU variants CP200 and Ethernet communication modules (All versions)

Exploitation Mechanism

Attackers can exploit the vulnerability by sending specially crafted packets to port 443/TCP, allowing them to manipulate files within the file system.

Mitigation and Prevention

Steps to address and prevent the CVE-2019-10930 vulnerability in Siemens AG products.

Immediate Steps to Take

Apply security patches provided by Siemens AG promptly.
Monitor network traffic for any suspicious activity.
Implement network segmentation to limit the impact of potential attacks.

Long-Term Security Practices

Regularly update and patch all Siemens AG products to mitigate known vulnerabilities.
Conduct regular security assessments and audits to identify and address any security gaps.

Patching and Updates

Stay informed about security updates and patches released by Siemens AG.
Ensure timely application of patches to all affected systems to prevent exploitation of the vulnerability.