What is CVE-2019-10935?

CVE-2019-10935 is a high-severity vulnerability in Siemens Simatic Pcs 7, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2019-07-11.

How severe is CVE-2019-10935?

High severity. CVSS v3 base score is 7.2 out of 10.

Arbitrary file upload in Siemens Simatic Pcs 7

CVE-2019-10935

A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd 11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC Professional (TIA Portal V13) (All versions), SIMATIC WinCC Professional (TIA Portal V14) (All versions < V14 SP1 Upd 9), SIMATIC WinCC Professional (TIA Portal V15) (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). The SIMATIC WinCC DataMonitor web application of the affected products allows to upload arbitrary ASPX code. The security vulnerability could be exploited by an authenticated attacker with network access to the WinCC DataMonitor application. No user interaction is required to exploit this vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the affected device. At the stage of publishing this security advisory no public exploitation is known.

Vulnerability class: Unrestricted File Upload

Published 2019-07-11 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.013 (70.0th percentile), scored 2026-10-21.

Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 70.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.011 · newest: 0.013 · change: +0.002

Affected products

Siemens Simatic Pcs 7 — versions 8.0, 8.1, 8.2
Siemens Simatic Wincc — versions 7.3, 7.4, 7.5
Siemens Simatic Wincc Runtime — versions 13, 14, 15
Siemens Ag Simatic Pcs 7 V8.0 And Earlier — versions All versions
Siemens Ag Simatic Pcs 7 V8.1 — versions All versions < V8.1 with WinCC V7.3 Upd 19
Siemens Ag Simatic Pcs 7 V8.2 — versions All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd 11
Siemens Ag Simatic Pcs 7 V9.0 — versions All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11
Siemens Ag Simatic Wincc Professional (Tia Portal V13) — versions All versions
Siemens Ag Simatic Wincc Professional (Tia Portal V14) — versions All versions < V14 SP1 Upd 9
Siemens Ag Simatic Wincc Professional (Tia Portal V15) — versions All versions < V15.1 Upd 3

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

cert-portal.siemens.com/productcert/pdf/ssa-121293.pdf (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2019-10935?: CVE-2019-10935 is a high-severity vulnerability in Siemens Simatic Pcs 7, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2019-07-11.
How severe is CVE-2019-10935?: High severity. CVSS v3 base score is 7.2 out of 10.