CVE-2019-13939

A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Series (BACnet) (All versions = V2.8.2 and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and < V6.00.327), Nucleus NET (All versions), Nucleus RTOS (All versions), Nucleus ReadyStart for ARM, MIPS, and PPC (All versions < V2017.02.2 with patch "Nucleus 2017.02.02 Nucleus NET Patch"), Nucleus SafetyCert (All versions), Nucleus Source Code (All versions), SIMOTICS CONNECT 400 (All versions < V0.3.0.330), TALON TC Series (BACnet) (All versions < V3.5.3), VSTAR (All versions). By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value. The vulnerability could affect availability and integrity of the device. Adjacent network access is required, but no authentication and no user interaction is needed to conduct an attack.

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf	Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-162506.pdf	Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-105-06

Configuration 1

cpe:2.3:o:siemens:nucleus_rtos:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:nucleus_readystart:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:nucleus_source_code:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:nucleus_safetycert:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:capital_vstar:*:*:*:*:*:*:*:*

---

Published : 2020-01-16 04:15

Updated : 2022-05-20 02:15

---

NVD link : CVE-2019-13939

Mitre link : CVE-2019-13939

Desigo Pxm20 Firmware

Siemens

NVD-CWE-noinfo