CVE-2019-10953

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
ABB	1SAP120600R0071 PM554-TP-ETH	Multiple
Phoenix Contact	2700974 ILC 151 ETH	Multiple
Phoenix Contact	ILC 191 ETH 2TX	Multiple
Schneider Electric	Modicon M221	< v1.10.0.0
Schneider Electric	EcoStruxure Machine Expert – Basic	< v1.0
Siemens	6ES7211-1AE40-0XB0 Simatic S7-1211	—
Siemens	6ES7314-6EH04-0AB0 Simatic S7-314	—
Siemens	6ED1052-1CC01-0BA8 Logo! 8	—
WAGO	750-889 Controller KNX IP	Multiple
WAGO	750-8100 Controller PFC100	Multiple
WAGO	750-880 Controller ETH	Multiple
WAGO	750-831 Controller BACnet/IP	Multiple

References

http://www.securityfocus.com/bid/108413Third Party Advisory, VDB Entry
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2019/icsa-19-106-03.json
https://ics-cert.us-cert.gov/advisories/ICSA-19-106-03Mitigation, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/108413Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-106-03Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Apr 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-109547.5An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable fault CVE-2019-109556.1In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 CVE-2019-109567.2Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote au CVE-2019-109574.8Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote au CVE-2019-109587.2Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote au CVE-2019-1095910.0BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impac CVE-2019-10965.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis CVE-2019-109607.5Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option t CVE-2019-109618.8In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user sup CVE-2019-109625.3BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway W CVE-2019-109634.3Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which ma CVE-2019-109647.1Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose