Skip to content
Fencer Intel
medium 6.8

CVE-2019-13945 json

A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl.

published 6y ago modified 4mo ago also EUVD-2019-5212

cvss
6.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family < V4.x (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family V4.x (incl. SIPLUS variants) (All versions with Function State (FS) < 11), SIMATIC S7-200 SMART CPU CR20s (6ES7 288-1CR20-0AA1) (All versions <= V2.3.0 and Function State (FS) <= 3), SIMATIC S7-200 SMART CPU CR30s (6ES7 288-1CR30-0AA1) (All versions <= V2.3.0 and Function State (FS) <= 3), SIMATIC S7-200 SMART CPU CR40 (6ES7 288-1CR40-0AA0) (All versions <= V2.2.2 and Function State (FS) <= 8), SIMATIC S7-200 SMART CPU CR40s (6ES7 288-1CR40-0AA1) (All versions <= V2.3.0 and Function State (FS) <= 3), SIMATIC S7-200 SMART CPU CR60 (6ES7 288-1CR60-0AA0) (All versions <= V2.2.2 and Function State (FS) <= 10), SIMATIC S7-200 SMART CPU CR60s (6ES7 288-1CR60-0AA1) (All versions <= V2.3.0 and Function State (FS) <= 3), SIMATIC S7-200 SMART CPU SR20 (6ES7 288-1SR20-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 11), SIMATIC S7-200 SMART CPU SR30 (6ES7 288-1SR30-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 10), SIMATIC S7-200 SMART CPU SR40 (6ES7 288-1SR40-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 10), SIMATIC S7-200 SMART CPU SR60 (6ES7 288-1SR60-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 12), SIMATIC S7-200 SMART CPU ST20 (6ES7 288-1ST20-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 9), SIMATIC S7-200 SMART CPU ST30 (6ES7 288-1ST30-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 9), SIMATIC S7-200 SMART CPU ST40 (6ES7 288-1ST40-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 8), SIMATIC S7-200 SMART CPU ST60 (6ES7 288-1ST60-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 8), SIMATIC S7-200 SMART CPU family (All versions). There is an access mode used during manufacturing of the affected devices that allows additional diagnostic functionality. The security vulnerability could be exploited by an attacker with physical access to the UART interface during boot process.

Is CVE-2019-13945 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-318-02 updated cvss 6.8

Siemens S7-1200 and S7-200 SMART CPUs (Update B)

  • Siemens SIMATIC S7-200 SMART CPU CR20s (6ES7 288-1CR20-0AA1) <=V2.3.0_and_Function_State_FS Siemens SIMATIC S7-200 SMART CPU CR30s (6ES7 288-1CR30-0AA1) <=V2.3.0_and_Function_State_FS Siemens SIMATIC S7-200 SMART CPU CR40 (6ES7 288-1CR40-0AA0) <=V2.2.2_and_Function_State_FS_8 Siemens SIMATIC S7-200 SMART CPU CR40s (6ES7 288-1CR40-0AA1) <=V2.3.0_and_Function_State_FS Siemens SIMATIC S7-200 SMART CPU CR60 (6ES7 288-1CR60-0AA0) <=V2.2.2_and_Function_State_FS_10 Siemens SIMATIC S7-200 SMART CPU CR60s (6ES7 288-1CR60-0AA1) <=V2.3.0_and_Function_State_FS
    +8 more products
    Siemens SIMATIC S7-200 SMART CPU SR20 (6ES7 288-1SR20-0AA0) <=V2.5.0_and_Function_State_FS_11 Siemens SIMATIC S7-200 SMART CPU SR30 (6ES7 288-1SR30-0AA0) <=V2.5.0_and_Function_State_FS_10 Siemens SIMATIC S7-200 SMART CPU SR40 (6ES7 288-1SR40-0AA0) <=V2.5.0_and_Function_State_FS_10 Siemens SIMATIC S7-200 SMART CPU SR60 (6ES7 288-1SR60-0AA0) <=V2.5.0_and_Function_State_FS_12 Siemens SIMATIC S7-200 SMART CPU ST20 (6ES7 288-1ST20-0AA0) <=V2.5.0_and_Function_State_FS_9 Siemens SIMATIC S7-200 SMART CPU ST30 (6ES7 288-1ST30-0AA0) <=V2.5.0_and_Function_State_FS_9 Siemens SIMATIC S7-200 SMART CPU ST40 (6ES7 288-1ST40-0AA0) <=V2.5.0_and_Function_State_FS_8 Siemens SIMATIC S7-200 SMART CPU ST60 (6ES7 288-1ST60-0AA0) <=V2.5.0_and_Function_State_FS_8
    affected: vendor fix, mitigation
  • Siemens SIMATIC S7-1200 CPU family < V4.x (incl.'SIPLUS variants)
    affected: mitigation, no fix available
  • Siemens SIMATIC S7-1200 CPU family V4.x (incl.'SIPLUS variants) <_with_Function_State_FS_11
    affected: vendor fix, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Siemens AG SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
  • Siemens AG SIMATIC S7-1200 CPU family < V4.x (incl. SIPLUS variants)
  • Siemens AG SIMATIC S7-1200 CPU family V4.x (incl. SIPLUS variants)
  • Siemens AG SIMATIC S7-200 SMART CPU CR20s (6ES7 288-1CR20-0AA1)
  • Siemens AG SIMATIC S7-200 SMART CPU CR30s (6ES7 288-1CR30-0AA1)
  • Siemens AG SIMATIC S7-200 SMART CPU CR40 (6ES7 288-1CR40-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU CR40s (6ES7 288-1CR40-0AA1)
  • Siemens AG SIMATIC S7-200 SMART CPU CR60 (6ES7 288-1CR60-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU CR60s (6ES7 288-1CR60-0AA1)
  • Siemens AG SIMATIC S7-200 SMART CPU SR20 (6ES7 288-1SR20-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU SR30 (6ES7 288-1SR30-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU SR40 (6ES7 288-1SR40-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU SR60 (6ES7 288-1SR60-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU ST20 (6ES7 288-1ST20-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU ST30 (6ES7 288-1ST30-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU ST40 (6ES7 288-1ST40-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU ST60 (6ES7 288-1ST60-0AA0)
  • Siemens AG SIMATIC S7-200 SMART CPU family

Classification

Weakness
  • CWE-749 Exposed Dangerous Method or Function

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.