high7.5
CVE-2019-13946
Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent…
Impact
Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Siemens | Dk Standard Ethernet Controller | All versions |
| Siemens | Profinet Driver | before 2.1 |
| Siemens | Simatic Ipc Support | All versions |
| Siemens | Ek-Ertec 200 Firmware | before 4.5 |
| Siemens | Ek-Ertec 200p Firmware | before 4.6 |
| Siemens | Ruggedcom Rm1224 Firmware | before 4.3 |
| Siemens | Scalance M-800 Firmware | before 4.3 |
| Siemens | Scalance S615 Firmware | before 4.3 |
| Siemens | Scalance W700 Ieee 802.11n Firmware | through 6.0.1 |
| Siemens | Scalance Xc-200 Firmware | All versions before 3.0 |
| Siemens | Scalance Xf-200 Firmware | All versions |
| Siemens | Scalance Xp-200 Firmware | All versions before 3.0 |