Out-of-bounds Read in Siemens Cp1604
CVE-2019-6568
The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation which leads to a restart of the webserver of the affected device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.014 (72.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- Siemens Cp1604
- Siemens Cp1604 Firmware
- Siemens Cp1616
- Siemens Cp1616 Firmware
- Siemens Simatic Cp 1604 — versions All versions
- Siemens Simatic Cp 1616 — versions All versions
- Siemens Simatic Cp 343-1 Advanced — versions All versions
- Siemens Simatic Cp343-1 Advanced
- Siemens Simatic Cp343-1 Advanced Firmware
- Siemens Simatic Cp 443-1 — versions All versions < V3.3
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf (Vendor Advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-530931.pdf (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-6568?
- CVE-2019-6568 is a high-severity vulnerability in Siemens Cp1604, classified under Out-of-bounds Read. CVSS score: 7.5/10. Published 2019-04-17.
- How severe is CVE-2019-6568?
- High severity. CVSS v3 base score is 7.5 out of 10.