Auth bypass in Siemens Sinetplan
CVE-2019-10915
A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration web application (TIA Administrator) allows to execute certain application commands without proper authentication. The vulnerability could be exploited by an attacker with local access to the affected system. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Vulnerability class: Broken Authentication
EPSS: 0.009 (57.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Siemens Sinetplan — versions 2.0
- Siemens Tia_administrator — versions 1.0
- Siemens Ag Tia Administrator — versions All versions < V1.0 SP1 Upd1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- productcert@siemens.com (Patch, x_refsource_MISC, Vendor Advisory)
- productcert@siemens.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- productcert@siemens.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- productcert@siemens.com (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-10915?
- CVE-2019-10915 is a high-severity vulnerability in Siemens Sinetplan, classified under Missing Authentication for Critical Function. CVSS score: 7.8/10. Published 2019-07-11.
- How severe is CVE-2019-10915?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2019-10915 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.