CVE-2019-9590

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service (persistent failure mode) by sending a series of \x19\xb2\x00\x00\x00\x06\x43\x01\x00\xac\xff\x00 (aka UID 0x43) requests to TCP port 502.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Ni9htMar3/vulnerability/blob/master/PLC/%E8%85%BE%E6%8E%A7/T920_PLC_DOS.mdExploit, Third Party Advisory
https://github.com/Ni9htMar3/vulnerability/blob/master/PLC/%E8%85%BE%E6%8E%A7/T920_PLC_DOS.mdExploit, Third Party Advisory

Timeline

Published: Mar 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-95916.1A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitr CVE-2019-95926.1A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web CVE-2019-95936.1A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web CVE-2019-95949.8BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request.CVE-2019-95956.1AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter.CVE-2019-95966.5Darktrace Enterprise Immune System before 3.1 allows CSRF via the /whitelisteddomains endpoint.CVE-2019-95976.5Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint.CVE-2019-95986.5An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds.CVE-2019-95997.5The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultane CVE-2019-96007.5The Olive Tree FTP Server (aka com.theolivetree.ftpserver) application through 1.32 for Android allows remote attackers to cause a denial of CVE-2019-96017.5The ApowerManager application through 3.1.7 for Android allows remote attackers to cause a denial of service via many simultaneous /?Key=Pho CVE-2019-96036.5MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.