Path Traversal in Siemens Tia Portal V14
CVE-2019-10934
A vulnerability has been identified in TIA Portal V14 (All versions), TIA Portal V15 (All versions < V15.1 Update 7), TIA Portal V16 (All versions < V16 Update 6), TIA Portal V17 (All versions < V17 Update 4). Changing the contents of a configuration file could allow an attacker to execute arbitrary code with SYSTEM privileges. The security vulnerability could be exploited by an attacker with a valid account and limited access rights on the system. No user interaction is required. At the time of advisory publication no public exploitation of this security vulnerability was known.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.004 (36.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Siemens Tia Portal V14 — versions All versions
- Siemens Tia Portal V15 — versions All versions < V15.1 Update 7
- Siemens Tia Portal V16 — versions All versions < V16 Update 6
- Siemens Tia Portal V17 — versions All versions < V17 Update 4
- Siemens Totally_integrated_automation_portal
Weakness classification (CWE)
References
- productcert@siemens.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-10934?
- CVE-2019-10934 is a high-severity vulnerability in Siemens Tia Portal V14, classified under Path Traversal. CVSS score: 7.8/10. Published 2020-01-16.
- How severe is CVE-2019-10934?
- High severity. CVSS v3 base score is 7.8 out of 10.