CVE-2019-10936

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Affected devices improperly handle large amounts of specially crafted UDP packets. This could allow an unauthenticated remote attacker to trigger a denial of service condition.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
SiemensDevelopment/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller< *
SiemensDevelopment/Evaluation Kits for PROFINET IO: EK-ERTEC 200< *
SiemensDevelopment/Evaluation Kits for PROFINET IO: EK-ERTEC 200PAll versions < V4.6 Patch 01
SiemensSIMATIC CFU PA< V1.2.0
SiemensSIMATIC ET 200AL IM 157-1 PNAll versions
SiemensSIMATIC ET 200M (incl. SIPLUS variants)All versions
SiemensSIMATIC ET 200MP IM 155-5 PN BA< V4.3.0
SiemensSIMATIC ET 200MP IM 155-5 PN HF< V4.4.0
SiemensSIMATIC ET 200MP IM 155-5 PN ST< *
SiemensSIMATIC ET 200MP IM 155-5 PN ST< *
SiemensSIMATIC ET 200pro IM 154-3 PN HF< *
SiemensSIMATIC ET 200pro IM 154-4 PN HF< *
SiemensSIMATIC ET 200pro IM 154-8 PN/DP CPUAll versions < V3.2.17
SiemensSIMATIC ET 200pro IM 154-8F PN/DP CPUAll versions < V3.2.17
SiemensSIMATIC ET 200pro IM 154-8FX PN/DP CPUAll versions < V3.2.17
SiemensSIMATIC ET 200S IM 151-8 PN/DP CPUAll versions < V3.2.17
SiemensSIMATIC ET 200S IM 151-8F PN/DP CPUAll versions < V3.2.17
SiemensSIMATIC ET 200SP IM 155-6 PN BA< *
SiemensSIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)All versions < V1.2.1
SiemensSIMATIC ET 200SP IM 155-6 PN HF< V4.2.2
SiemensSIMATIC ET 200SP IM 155-6 PN HS< V4.0.1
SiemensSIMATIC ET 200SP IM 155-6 PN ST< *
SiemensSIMATIC ET 200SP IM 155-6 PN ST< *
SiemensSIMATIC ET 200SP IM 155-6 PN ST BA< *
SiemensSIMATIC ET 200SP IM 155-6 PN ST BA< *
SiemensSIMATIC ET 200SP IM 155-6 PN/2 HF< V4.2.2
SiemensSIMATIC ET 200SP IM 155-6 PN/3 HF< V4.2.1
SiemensSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)< V2.0
SiemensSIMATIC ET200ecoPN, 16DI, DC24V, 8xM12All versions
SiemensSIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12All versions
SiemensSIMATIC ET200ecoPN, 4AO U/I 4xM12All versions
SiemensSIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12All versions
SiemensSIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12All versions
SiemensSIMATIC ET200ecoPN, 8AI RTD/TC 8xM12All versions
SiemensSIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12All versions
SiemensSIMATIC ET200ecoPN, 8DI, DC24V, 4xM12All versions
SiemensSIMATIC ET200ecoPN, 8DI, DC24V, 8xM12All versions
SiemensSIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12All versions
SiemensSIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12All versions
SiemensSIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12All versions
SiemensSIMATIC ET200ecoPN: IO-Link MasterAll versions
SiemensSIMATIC ET200S (incl. SIPLUS variants)All versions
SiemensSIMATIC HMI Comfort Outdoor Panels (incl. SIPLUS variants)< *
SiemensSIMATIC HMI Comfort Panels (incl. SIPLUS variants)< *
SiemensSIMATIC HMI KTP Mobile Panels< *
SiemensSIMATIC PN/PN CouplerAll versions < V4.2.1
SiemensSIMATIC PROFINET DriverAll versions < V2.1
SiemensSIMATIC S7-1200 CPU family (incl. SIPLUS variants)All versions < V4.4.0
SiemensSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)All versions < V2.0
SiemensSIMATIC S7-1500 Software ControllerAll versions < V2.0

References

Timeline

Published
Oct 10, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-109377.5A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to the device could causeCVE-2019-109389.8A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU varianCVE-2019-109399.8A vulnerability has been identified in TIM 3V-IE (incl. SIPLUS NET variants) (All versions < V2.8), TIM 3V-IE Advanced (incl. SIPLUS NET varCVE-2019-10946.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-109409.9A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attackCVE-2019-109415.3A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires adminiCVE-2019-109428.6A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sCVE-2019-109437.5A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl.CVE-2019-109459.8An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attacCVE-2019-109467.5An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls fCVE-2019-109477.8Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities maCVE-2019-109487.5Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X are suscepti
CVE-2019-10936: High severity, CVSS 7.5 | Vulnix