CVE-2019-13537

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
AVEVA	Vijeo Citect and Citect SCADA	IEC870IP driver v4.14.02 and prior

References

https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec139.pdfVendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-290-01Third Party Advisory, US Government Resource
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec139.pdfVendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-290-01Third Party Advisory, US Government Resource

Timeline

Published: Jan 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-135388.63S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library con CVE-2019-135397.8Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and CVE-2019-13548.8A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E CVE-2019-135407.8Delta Electronics TPEditor, Versions 1.94 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing spe CVE-2019-135417.8In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processi CVE-2019-135426.53S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests fr CVE-2019-135437.5Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and CVE-2019-135447.8Delta Electronics TPEditor, Versions 1.94 and prior. Multiple out-of-bounds write vulnerabilities may be exploited by processing specially c CVE-2019-135457.8In Horner Automation Cscape 9.90 and prior, improper validation of data may cause the system to write outside the intended buffer area, whic CVE-2019-135466.8In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an u CVE-2019-135479.8Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use t CVE-2019-135489.8CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could caus