Action not permitted
Modal body text goes here.
Modal Title
Modal Body
ghsa-jpvr-c9fc-2r4h
Vulnerability from github
Published
2022-05-24 17:06
Modified
2025-03-11 12:30
Severity ?
7.1 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
7.1 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
7.1 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
VLAI Severity ?
Details
A vulnerability has been identified in Nucleus NET (All versions), Nucleus RTOS (All versions), Nucleus ReadyStart for ARM, MIPS, and PPC (All versions < V2017.02.2 with patch "Nucleus 2017.02.02 Nucleus NET Patch"), Nucleus SafetyCert (All versions), Nucleus Source Code (All versions), VSTAR (All versions). By sending specially crafted DHCP packets to a device, an attacker may be able to affect availability and integrity of the device. Adjacent network access, but no authentication and no user interaction is needed to conduct this attack. At the time of advisory publication no public exploitation of this security vulnerability was known.
{ "affected": [], "aliases": [ "CVE-2019-13939" ], "database_specific": { "cwe_ids": [ "CWE-20" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2020-01-16T16:15:00Z", "severity": "MODERATE" }, "details": "A vulnerability has been identified in Nucleus NET (All versions), Nucleus RTOS (All versions), Nucleus ReadyStart for ARM, MIPS, and PPC (All versions \u003c V2017.02.2 with patch \"Nucleus 2017.02.02 Nucleus NET Patch\"), Nucleus SafetyCert (All versions), Nucleus Source Code (All versions), VSTAR (All versions). By sending specially crafted DHCP packets to a device, an attacker may be able to affect availability and integrity of the device. Adjacent network access, but no authentication and no user interaction is needed to conduct this attack. At the time of advisory publication no public exploitation of this security vulnerability was known.", "id": "GHSA-jpvr-c9fc-2r4h", "modified": "2025-03-11T12:30:58Z", "published": "2022-05-24T17:06:47Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13939" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-162506.html" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-434032.html" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-162506.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf" }, { "type": "WEB", "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-105-06" }, { "type": "WEB", "url": "https://www.us-cert.gov/ics/advisories/icsa-20-105-06" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "type": "CVSS_V4" } ] }
CVE-2019-13939 (GCVE-0-2019-13939)
Vulnerability from cvelistv5
Published
2020-01-16 15:35
Modified
2025-06-10 15:17
Severity ?
7.1 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
7.1 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
7.1 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
Summary
A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC00-U (All versions >= V2.3x and < V6.00.327), Desigo PXC001-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC100-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC12-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC128-U (All versions >= V2.3x and < V6.00.327), Desigo PXC200-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC36.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC50-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC64-U (All versions >= V2.3x and < V6.00.327), Desigo PXM20-E (All versions >= V2.3 < V6.0.327), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus Source Code (All versions), SIMOTICS CONNECT 400 (All versions < V0.3.0.330), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
► | Siemens | APOGEE MEC/MBC/PXC (P2) |
Version: All versions < V2.8.2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T00:05:43.738Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-162506.pdf" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-105-06" }, { "tags": [ "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/html/ssa-434032.html" }, { "tags": [ "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/html/ssa-162506.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "product": "APOGEE MEC/MBC/PXC (P2)", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V2.8.2" } ] }, { "defaultStatus": "unknown", "product": "APOGEE PXC Compact (BACnet)", "vendor": "Siemens", "versions": [ { "lessThan": "V3.5.3", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "APOGEE PXC Compact (P2 Ethernet)", "vendor": "Siemens", "versions": [ { "lessThan": "V2.8.19", "status": "affected", "version": "V2.8.2", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "APOGEE PXC Modular (BACnet)", "vendor": "Siemens", "versions": [ { "lessThan": "V3.5.3", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "APOGEE PXC Modular (P2 Ethernet)", "vendor": "Siemens", "versions": [ { "lessThan": "V2.8.19", "status": "affected", "version": "V2.8.2", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Capital Embedded AR Classic 431-422", "vendor": "Siemens", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Capital Embedded AR Classic R20-11", "vendor": "Siemens", "versions": [ { "lessThan": "V2303", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC00-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC00-U", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003e= V2.3x and \u003c V6.00.327" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC001-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC100-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC12-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC128-U", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003e= V2.3x and \u003c V6.00.327" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC200-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC22-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC22.1-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC36.1-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC50-E.D", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXC64-U", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003e= V2.3x and \u003c V6.00.327" } ] }, { "defaultStatus": "unknown", "product": "Desigo PXM20-E", "vendor": "Siemens", "versions": [ { "lessThan": "V6.0.327", "status": "affected", "version": "V2.3", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Nucleus NET", "vendor": "Siemens", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Nucleus ReadyStart V3", "vendor": "Siemens", "versions": [ { "lessThan": "V2017.02.3", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "Nucleus Source Code", "vendor": "Siemens", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "SIMOTICS CONNECT 400", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V0.3.0.330" } ] }, { "defaultStatus": "unknown", "product": "TALON TC Compact (BACnet)", "vendor": "Siemens", "versions": [ { "lessThan": "V3.5.3", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "TALON TC Modular (BACnet)", "vendor": "Siemens", "versions": [ { "lessThan": "V3.5.3", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions \u003c V2.8.2), APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions \u003e= V2.8.2 \u003c V2.8.19), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions \u003e= V2.8.2 \u003c V2.8.19), Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions \u003c V2303), Desigo PXC00-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC00-U (All versions \u003e= V2.3x and \u003c V6.00.327), Desigo PXC001-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC100-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC12-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC128-U (All versions \u003e= V2.3x and \u003c V6.00.327), Desigo PXC200-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC22-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC22.1-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC36.1-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC50-E.D (All versions \u003e= V2.3 \u003c V6.0.327), Desigo PXC64-U (All versions \u003e= V2.3x and \u003c V6.00.327), Desigo PXM20-E (All versions \u003e= V2.3 \u003c V6.0.327), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions \u003c V2017.02.3), Nucleus Source Code (All versions), SIMOTICS CONNECT 400 (All versions \u003c V0.3.0.330), TALON TC Compact (BACnet) (All versions \u003c V3.5.3), TALON TC Modular (BACnet) (All versions \u003c V3.5.3). By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value." } ], "metrics": [ { "cvssV3_1": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" } }, { "cvssV4_0": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "version": "4.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-06-10T15:17:09.328Z", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-162506.pdf" }, { "tags": [ "x_refsource_MISC" ], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-105-06" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-434032.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-162506.html" } ] } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2019-13939", "datePublished": "2020-01-16T15:35:24", "dateReserved": "2019-07-18T00:00:00", "dateUpdated": "2025-06-10T15:17:09.328Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…