Message Protection Bypass Vulnerability in Siemens SIMATIC Products
CVE-2019-10929

5.9MEDIUM

Key Information:

Vendor

Siemens
Status
Simatic Cp 1626
Simatic Et 200sp Open Controller Cpu 1515sp Pc (incl. Siplus Variants)
Simatic Et 200sp Open Controller Cpu 1515sp Pc2 (incl. Siplus Variants)
Simatic Hmi Panel (incl. Siplus Variants)
Vendor
CVE Published:
13 August 2019

What is CVE-2019-10929?

A message protection bypass vulnerability exists in various Siemens SIMATIC products that affects the integrity protection calculations. This flaw could allow a Man-in-the-Middle attacker to intercept and alter network traffic directed at the vulnerable devices, which operate over port 102/tcp. The issue arises from specific properties in the integrity protection mechanism, potentially compromising the security and functionality of the devices involved.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SIMATIC CP 1626 All versions

SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) All versions

SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) All versions < V20.8

References

https://cert-portal.siemens.com/productcert/pdf/ssa-23241...
x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/ssa-27379...
x_refsource_MISC
https://www.us-cert.gov/ics/advisories/icsa-19-344-04
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.