Skip to content
Fencer Intel
high 7.5

CVE-2019-10923 json

An attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (I…

published 7y ago modified 4mo ago also EUVD-2019-2637

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

An attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (IRT) of the affected installation.

Patch / fix

  • Siemens SIMATIC ET 200MP IM 155-5 PN HF V4.2.0
  • Siemens SIMATIC ET 200MP IM 155-5 PN ST V4.1.0
  • Siemens SIMATIC ET 200SP IM 155-6 PN HF V4.2.0
  • Siemens SIMATIC ET 200SP IM 155-6 PN ST V4.1.0
  • Siemens SIMATIC ET 200SP IM 155-6 PN ST BA V4.1.0
  • Siemens SIMATIC S7-400 CPU 412-2 PN V7 V7.0.3
  • Siemens SIMATIC S7-400 CPU 414-3 PN/DP V7 V7.0.3
  • Siemens SIMATIC S7-400 CPU 414F-3 PN/DP V7 V7.0.3
  • Siemens SIMATIC S7-400 CPU 416-3 PN/DP V7 V7.0.3
  • Siemens SIMATIC S7-400 CPU 416F-3 PN/DP V7 V7.0.3

Is CVE-2019-10923 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-283-01 updated cvss 7.5

Siemens Industrial Real-Time (IRT) Devices

  • Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller <V4.1.1_Patch_05
    affected: fixed in V4.1.1, mitigation support.industry.siemens.com
  • Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 <V4.5.0_Patch_01
    affected: fixed in V4.5.0, mitigation support.industry.siemens.com
  • Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P <V4.5.0
    affected: fixed in V4.5.0, mitigation support.industry.siemens.com
  • Siemens SCALANCE X-200IRT family (incl. SIPLUS NET variants) <V5.2.1
    affected: fixed in V5.4.2, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1604 (6GK1160-4AA01) <V2.8 Siemens SIMATIC CP 1616 (6GK1161-6AA02) <V2.8
    affected: fixed in V2.8, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200M (incl. SIPLUS variants)
    affected: mitigation, no fix planned
  • Siemens SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) <V4.2.0
    affected: fixed in V4.2.0, mitigation
  • Siemens SIMATIC ET 200MP IM 155-5 PN ST (6ES7155-5AA00-0AB0) <V4.1.0
    affected: fixed in V4.1.0, mitigation
show 15 more
  • Siemens SIMATIC ET 200pro IM 154-3 PN HF (6ES7154-3AB00-0AB0) Siemens SIMATIC ET 200pro IM 154-4 PN HF (6ES7154-4AB10-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0) <V4.2.0
    affected: fixed in V4.2.0, mitigation
  • Siemens SIMATIC ET 200SP IM 155-6 PN ST (6ES7155-6AU00-0BN0) <V4.1.0 Siemens SIMATIC ET 200SP IM 155-6 PN ST BA (6ES7155-6AA00-0BN0) <V4.1.0
    affected: fixed in V4.1.0, mitigation
  • Siemens SIMATIC ET200ecoPN, 4AO U/I 4xM12 (6ES7145-6HD00-0AB0) Siemens SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12 (6ES7147-6BG00-0AB0) Siemens SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12 (6ES7142-6BR00-0AB0) Siemens SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12 (6ES7144-6KD50-0AB0) Siemens SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12 (6ES7144-6KD00-0AB0) Siemens SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12 (6ES7141-6BF00-0AB0)
    +9 more products
    Siemens SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12 (6ES7141-6BG00-0AB0) Siemens SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12 (6ES7142-6BF50-0AB0) Siemens SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12 (6ES7142-6BF00-0AB0) Siemens SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12 (6ES7142-6BG00-0AB0) Siemens SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12 (6ES7141-6BH00-0AB0) Siemens SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12 (6ES7142-6BH00-0AB0) Siemens SIMATIC ET200ecoPN: IO-Link Master (6ES7148-6JA00-0AB0) Siemens SIMATIC ET200S (incl. SIPLUS variants) Siemens SIMATIC PN/PN Coupler (incl. SIPLUS NET variants)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0) <V3.2.17
    affected: fixed in V3.2.17, mitigation support.industry.siemens.com

50 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.40% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller
  • Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200
  • Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P
  • Siemens SCALANCE X-200IRT family (incl. SIPLUS NET variants)
  • Siemens SIMATIC CP 1604
  • Siemens SIMATIC CP 1616
  • Siemens SIMATIC ET 200M (incl. SIPLUS variants)
  • Siemens SIMATIC ET 200MP IM 155-5 PN HF
  • Siemens SIMATIC ET 200MP IM 155-5 PN ST
  • Siemens SIMATIC ET 200pro IM 154-3 PN HF
  • Siemens SIMATIC ET 200pro IM 154-4 PN HF
  • Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU
  • Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU
  • Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU
  • Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU
  • Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU
  • Siemens SIMATIC ET 200SP IM 155-6 PN HF
  • Siemens SIMATIC ET 200SP IM 155-6 PN ST
  • Siemens SIMATIC ET 200SP IM 155-6 PN ST BA
  • Siemens SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12
  • Siemens SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12
  • Siemens SIMATIC ET200ecoPN, 4AO U/I 4xM12
  • Siemens SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12
  • Siemens SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12
  • Siemens SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12
  • Siemens SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12
  • Siemens SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12
  • Siemens SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12
  • Siemens SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12
  • Siemens SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12
  • Siemens SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12
  • Siemens SIMATIC ET200ecoPN: IO-Link Master
  • Siemens SIMATIC ET200S (incl. SIPLUS variants)
  • Siemens SIMATIC PN/PN Coupler (incl. SIPLUS NET variants)
  • Siemens SIMATIC S7-300 CPU 314C-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315F-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315T-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 317-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 317F-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 317T-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 319-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 319F-3 PN/DP
  • Siemens SIMATIC S7-400 CPU 412-2 PN V7
  • Siemens SIMATIC S7-400 CPU 414-3 PN/DP V7
  • Siemens SIMATIC S7-400 CPU 414F-3 PN/DP V7
  • Siemens SIMATIC S7-400 CPU 416-3 PN/DP V7
  • Siemens SIMATIC S7-400 CPU 416F-3 PN/DP V7
  • Siemens SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants)

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.