CVE-2019-13946

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack.

The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
SiemensDevelopment/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller< *
SiemensDevelopment/Evaluation Kits for PROFINET IO: EK-ERTEC 200All Versions < V4.5
SiemensDevelopment/Evaluation Kits for PROFINET IO: EK-ERTEC 200PAll Versions < V4.6
SiemensPROFINET Driver for ControllerAll Versions < V2.1
SiemensRUGGEDCOM RM1224 familyAll versions < V4.3
SiemensSCALANCE M804PBAll versions < V4.3
SiemensSCALANCE M812-1 ADSL-RouterAll versions < V4.3
SiemensSCALANCE M812-1 ADSL-RouterAll versions < V4.3
SiemensSCALANCE M816-1 ADSL-RouterAll versions < V4.3
SiemensSCALANCE M816-1 ADSL-RouterAll versions < V4.3
SiemensSCALANCE M826-2 SHDSL-RouterAll versions < V4.3
SiemensSCALANCE M874-2All versions < V4.3
SiemensSCALANCE M874-3All versions < V4.3
SiemensSCALANCE M876-3All versions < V4.3
SiemensSCALANCE M876-3 (ROK)All versions < V4.3
SiemensSCALANCE M876-4 (EU)All versions < V4.3
SiemensSCALANCE M876-4 (NAM)All versions < V4.3
SiemensSCALANCE S615 LAN-RouterAll versions < V4.3
SiemensSCALANCE W-700 IEEE 802.11n familyAll versions <= V6.0.1
SiemensSCALANCE X200-4P IRTAll Versions < V5.3
SiemensSCALANCE X201-3P IRTAll Versions < V5.3
SiemensSCALANCE X201-3P IRT PROAll Versions < V5.3
SiemensSCALANCE X202-2IRTAll Versions < V5.3
SiemensSCALANCE X202-2P IRTAll Versions < V5.3
SiemensSCALANCE X202-2P IRT PROAll Versions < V5.3
SiemensSCALANCE X204-2All versions < V5.2.5
SiemensSCALANCE X204-2FMAll versions < V5.2.5
SiemensSCALANCE X204-2LDAll versions < V5.2.5
SiemensSCALANCE X204-2LD TSAll versions < V5.2.5
SiemensSCALANCE X204-2TSAll versions < V5.2.5
SiemensSCALANCE X204IRTAll Versions < V5.3
SiemensSCALANCE X204IRT PROAll Versions < V5.3
SiemensSCALANCE X206-1All versions < V5.2.5
SiemensSCALANCE X206-1LDAll versions < V5.2.5
SiemensSCALANCE X208All versions < V5.2.5
SiemensSCALANCE X208PROAll versions < V5.2.5
SiemensSCALANCE X212-2All versions < V5.2.5
SiemensSCALANCE X212-2LDAll versions < V5.2.5
SiemensSCALANCE X216All versions < V5.2.5
SiemensSCALANCE X224All versions < V5.2.5
SiemensSCALANCE X302-7 EEC (230V, coated)All versions < V4.1.4
SiemensSCALANCE X302-7 EEC (230V)All versions < V4.1.4
SiemensSCALANCE X302-7 EEC (24V, coated)All versions < V4.1.4
SiemensSCALANCE X302-7 EEC (24V)All versions < V4.1.4
SiemensSCALANCE X302-7 EEC (2x 230V, coated)All versions < V4.1.4
SiemensSCALANCE X302-7 EEC (2x 230V)All versions < V4.1.4
SiemensSCALANCE X302-7 EEC (2x 24V, coated)All versions < V4.1.4
SiemensSCALANCE X302-7 EEC (2x 24V)All versions < V4.1.4
SiemensSCALANCE X304-2FEAll versions < V4.1.4
SiemensSCALANCE X306-1LD FEAll versions < V4.1.4

References

Timeline

Published
Feb 11, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-139474.9A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The user configuration menu in the web interfaceCVE-2019-139485.4SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads,CVE-2019-139498.8SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin passworCVE-2019-13957.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2019-139505.4index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.CVE-2019-139519.8The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv4 addresCVE-2019-139529.8The set_ipv6() function in zscan_rfc1035.rl in gdnsd before 2.4.3 and 3.x before 3.2.1 has a stack-based buffer overflow via a long and malfCVE-2019-139538.8An exploitable authentication bypass vulnerability exists in the Bluetooth Low Energy (BLE) authentication module of YI M1 Mirrorless CameraCVE-2019-139546.5Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticCVE-2019-139556.5Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticaCVE-2019-139569.8Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing CVE-2019-139579.8In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter.
CVE-2019-13946: High severity, CVSS 7.5 | Vulnix