Skip to content
Fencer Intel
high 7.5

CVE-2019-13946 json

Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic packa…

published 6y ago modified 4mo ago also EUVD-2019-5213

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack.

The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.

Patch / fix

  • siemens profinet_driver 2.1
  • siemens ek-ertec_200_firmware 4.5
  • siemens ek-ertec_200p_firmware 4.6
  • siemens ruggedcom_rm1224_firmware 4.3
  • siemens scalance_m-800_firmware 4.3
  • siemens scalance_s615_firmware 4.3
  • siemens scalance_x-200irt_firmware 5.3
  • siemens scalance_xr-300wg_firmware 3.0
  • siemens scalance_xb-200_firmware 3.0
  • siemens scalance_xc-200_firmware 3.0
  • siemens scalance_xp-200_firmware 3.0
  • siemens scalance_xf-200ba_firmware 3.0
  • siemens scalance_x-400_firmware 6.0
  • siemens scalance_xm-400_firmware 6.0
  • siemens scalance_xr524_firmware 6.0
  • siemens scalance_xr526_firmware 6.0
  • siemens scalance_xr528_firmware 6.0
  • siemens scalance_xr552_firmware 6.0
  • siemens simatic_cp_1616_firmware 2.8
  • siemens simatic_cp_1604_firmware 2.8

Is CVE-2019-13946 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-042-04 updated cvss 7.5

Siemens PROFINET-IO Stack (Update H)

  • Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller
    affected: mitigation, no fix planned
  • Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 <V4.5
    affected: fixed in V4.5, mitigation support.industry.siemens.com
  • Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P <V4.6
    affected: fixed in V4.6, mitigation support.industry.siemens.com
  • Siemens PROFINET Driver for Controller <V2.1
    affected: fixed in V2.1, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RM1224 family (6GK6108-4AM00) <V4.3 Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) <V4.3 Siemens SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) <V4.3 Siemens SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) <V4.3 Siemens SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) <V4.3 Siemens SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) <V4.3
    +8 more products
    Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) <V4.3 Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) <V4.3 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) <V4.3 Siemens SCALANCE M876-3 (6GK5876-3AA02-2BA2) <V4.3 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) <V4.3 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) <V4.3 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) <V4.3 Siemens SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) <V4.3
    affected: fixed in V6.1.2, mitigation support.industry.siemens.com
  • Siemens SCALANCE W-700 IEEE 802.11n family <=V6.0.1
    affected: fixed in V6.4, mitigation support.industry.siemens.com
  • Siemens SCALANCE X200-4P IRT (6GK5200-4AH00-2BA3) <V5.3 Siemens SCALANCE X201-3P IRT (6GK5201-3BH00-2BA3) <V5.3 Siemens SCALANCE X201-3P IRT PRO (6GK5201-3JR00-2BA6) <V5.3 Siemens SCALANCE X202-2IRT (6GK5202-2BB00-2BA3) <V5.3 Siemens SCALANCE X202-2P IRT (6GK5202-2BH00-2BA3) <V5.3 Siemens SCALANCE X202-2P IRT PRO (6GK5202-2JR00-2BA6) <V5.3
    affected: fixed in V5.4.2, mitigation support.industry.siemens.com
  • Siemens SCALANCE X204-2 (6GK5204-2BB10-2AA3) <V5.2.5 Siemens SCALANCE X204-2FM (6GK5204-2BB11-2AA3) <V5.2.5 Siemens SCALANCE X204-2LD (6GK5204-2BC10-2AA3) <V5.2.5 Siemens SCALANCE X204-2LD TS (6GK5204-2BC10-2CA2) <V5.2.5 Siemens SCALANCE X204-2TS (6GK5204-2BB10-2CA2) <V5.2.5
    affected: fixed in V5.2.5, mitigation support.industry.siemens.com
show 2 more
  • Siemens SCALANCE X204IRT (6GK5204-0BA00-2BA3) <V5.3 Siemens SCALANCE X204IRT PRO (6GK5204-0JA00-2BA6) <V5.3
    affected: fixed in V5.4.2, mitigation support.industry.siemens.com
  • Siemens SCALANCE X206-1 (6GK5206-1BB10-2AA3) <V5.2.5 Siemens SCALANCE X206-1LD (6GK5206-1BC10-2AA3) <V5.2.5 Siemens SCALANCE X208 (6GK5208-0BA10-2AA3) <V5.2.5 Siemens SCALANCE X208PRO (6GK5208-0HA10-2AA6) <V5.2.5 Siemens SCALANCE X212-2 (6GK5212-2BB00-2AA3) <V5.2.5 Siemens SCALANCE X212-2LD (6GK5212-2BC00-2AA3) <V5.2.5
    +2 more products
    Siemens SCALANCE X216 (6GK5216-0BA00-2AA3) <V5.2.5 Siemens SCALANCE X224 (6GK5224-0BA00-2AA3) <V5.2.5
    affected: fixed in V5.2.5, mitigation support.industry.siemens.com

158 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2y ago

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller
  • Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200
  • Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P
  • Siemens PROFINET Driver for Controller
  • Siemens RUGGEDCOM RM1224 family
  • Siemens SCALANCE M804PB
  • Siemens SCALANCE M812-1 ADSL-Router
  • Siemens SCALANCE M816-1 ADSL-Router
  • Siemens SCALANCE M826-2 SHDSL-Router
  • Siemens SCALANCE M874-2
  • Siemens SCALANCE M874-3
  • Siemens SCALANCE M876-3
  • Siemens SCALANCE M876-3 (ROK)
  • Siemens SCALANCE M876-4 (EU)
  • Siemens SCALANCE M876-4 (NAM)
  • Siemens SCALANCE S615 LAN-Router
  • Siemens SCALANCE W-700 IEEE 802.11n family
  • Siemens SCALANCE X200-4P IRT
  • Siemens SCALANCE X201-3P IRT
  • Siemens SCALANCE X201-3P IRT PRO
  • Siemens SCALANCE X202-2IRT
  • Siemens SCALANCE X202-2P IRT
  • Siemens SCALANCE X202-2P IRT PRO
  • Siemens SCALANCE X204-2
  • Siemens SCALANCE X204-2FM
  • Siemens SCALANCE X204-2LD
  • Siemens SCALANCE X204-2LD TS
  • Siemens SCALANCE X204-2TS
  • Siemens SCALANCE X204IRT
  • Siemens SCALANCE X204IRT PRO
  • Siemens SCALANCE X206-1
  • Siemens SCALANCE X206-1LD
  • Siemens SCALANCE X208
  • Siemens SCALANCE X208PRO
  • Siemens SCALANCE X212-2
  • Siemens SCALANCE X212-2LD
  • Siemens SCALANCE X216
  • Siemens SCALANCE X224
  • Siemens SCALANCE X302-7 EEC (230V, coated)
  • Siemens SCALANCE X302-7 EEC (230V)
  • Siemens SCALANCE X302-7 EEC (24V, coated)
  • Siemens SCALANCE X302-7 EEC (24V)
  • Siemens SCALANCE X302-7 EEC (2x 230V, coated)
  • Siemens SCALANCE X302-7 EEC (2x 230V)
  • Siemens SCALANCE X302-7 EEC (2x 24V, coated)
  • Siemens SCALANCE X302-7 EEC (2x 24V)
  • Siemens SCALANCE X304-2FE
  • Siemens SCALANCE X306-1LD FE
  • Siemens SCALANCE X307-2 EEC (230V, coated)
  • Siemens SCALANCE X307-2 EEC (230V)

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.