1. Home
  2. CVE Database
  3. CVE-2019-13939
HIGH · 7.1

CVE-2019-13939

A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8.2 < ...

Vulnerability Description

A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC00-U (All versions >= V2.3x and < V6.00.327), Desigo PXC001-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC100-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC12-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC128-U (All versions >= V2.3x and < V6.00.327), Desigo PXC200-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC36.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC50-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC64-U (All versions >= V2.3x and < V6.00.327), Desigo PXM20-E (All versions >= V2.3 < V6.0.327), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus Source Code (All versions), SIMOTICS CONNECT 400 (All versions < V0.3.0.330), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value.

CVSS Score

7.1

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
HIGH

Affected Products

VendorProductVersions
SiemensCapital VstarAll versions
SiemensNucleus NetAll versions
SiemensNucleus Readystart< 2017.02.2
SiemensNucleus SafetycertAll versions
SiemensNucleus Source CodeAll versions
SiemensNucleus RtosAll versions
SiemensApogee Modular Equiment Controller Firmware< 2.8.2
SiemensApogee Modular Equiment Controller-
SiemensApogee Modular Building Controller Firmware< 2.8.2
SiemensApogee Modular Building Controller-
SiemensApogee Pxc Firmware<= 2.8.2
SiemensApogee Pxc-
SiemensDesigo Pxc Firmware>= 2.3
SiemensDesigo Pxc-
SiemensDesigo Pxm20 Firmware>= 2.3
SiemensDesigo Pxm20-
SiemensSimotics Connect 400 Firmware<= 0.3.0.95
SiemensSimotics Connect 400-
SiemensTalon Tc Firmware>= 3.0
SiemensTalon Tc-

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2019-13939?

CVE-2019-13939 is a vulnerability with a CVSS score of 7.1 (HIGH). A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8.2 < ...

How severe is CVE-2019-13939?

CVE-2019-13939 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-13939?

Check the references section above for vendor advisories and patch information. Affected products include: Siemens Capital Vstar, Siemens Nucleus Net, Siemens Nucleus Readystart, Siemens Nucleus Safetycert, Siemens Nucleus Source Code.