Skip to content
Fencer Intel
high 7.5

CVE-2019-6568 json

The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition.

published 7y ago modified 4mo ago also EUVD-2019-16127

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation which leads to a restart of the webserver of the affected device.

The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device.

Patch / fix

  • siemens simatic_ipc_diagmonitor 5.1.3
  • siemens simatic_s7-1500_software_controller 2.7
  • siemens simatic_s7-plcsim_advanced 2.0
  • siemens simatic_wincc_runtime_advanced 15.1
  • siemens sitop_manager 1.1
  • siemens simatic_rf185c_firmware 1.1.0
  • siemens simatic_et_200_sp_open_controller_cpu_1515sp_pc_firmware 2.1.6
  • siemens simatic_et_200_sp_open_controller_cpu_1515sp_pc2_firmware 2.7
  • siemens simatic_hmi_comfort_outdoor_panels_firmware 15.1
  • siemens simatic_hmi_comfort_panels_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp400f_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp700_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp700f_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp900_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp900f_firmware 15.1
  • siemens simatic_rf600r_firmware 3.2.1
  • siemens simatic_rf188c_firmware 1.1.0
  • siemens simatic_rf186c_firmware 1.1.0
  • siemens simatic_s7-1500_firmware 2.6.1
  • siemens simatic_s7-300_firmware 3.3.17

Is CVE-2019-6568 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-099-06 updated cvss 7.5

Siemens SIMATIC, SIMOCODE, SINAMICS, SITOP, and TIM (Update I)

  • Siemens SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) <V3.3 Siemens SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) <V3.3 Siemens SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) <V3.3
    affected: fixed in V3.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 443-1 OPC UA (6GK7443-1UX00-0XE0) Siemens SIMATIC CP 1604 (6GK1160-4AA01) Siemens SIMATIC CP 1616 (6GK1161-6AA02)
    affected: mitigation, no fix planned
  • Siemens SIMATIC ET 200pro IM154-8 PN/DP CPU (6ES7154-8AB01-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200pro IM154-8F PN/DP CPU (6ES7154-8FB01-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200pro IM154-8FX PN/DP CPU (6ES7154-8FX00-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200S IM151-8 PN/DP CPU (6ES7151-8AB01-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200S IM151-8F PN/DP CPU (6ES7151-8FB01-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
show 23 more
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) <V2.1.6
    affected: fixed in V2.1.6, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) <V2.7
    affected: fixed in V2.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) <V15.1_Upd4 Siemens SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) <V15.1_Upd4 Siemens SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F <V15.1_Upd4
    affected: fixed in V15.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC IPC DiagMonitor <V5.1.3
    affected: fixed in V5.1.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC RF182C (6GT2002-0JD10)
    affected: mitigation, no fix planned
  • Siemens SIMATIC RF185C (6GT2002-0JE10) <V1.1.0 Siemens SIMATIC RF186C (6GT2002-0JE20) <V1.1.0 Siemens SIMATIC RF188C (6GT2002-0JE40) <V1.1.0
    affected: fixed in V1.1.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC RF600R family <V3.2.1
    affected: fixed in V3.2.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC RFID 181EIP (6GT2002-0JD20)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0) <V3.3.16
    affected: fixed in V3.3.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0) <V3.2.16
    affected: fixed in V3.2.16, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) Siemens SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) <V2.6.1
    affected: fixed in V2.6.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 Software Controller <V2.7
    affected: fixed in V2.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-PLCSIM Advanced <V2.0_SP1_UPD1
    affected: fixed in V2.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC Teleservice Adapter IE Advanced
    affected: mitigation, no fix planned

46 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-19-227-04 updated cvss 7.5

Siemens SINAMICS (Update C)

  • Siemens SINAMICS GH150 V4.7 (Control Unit) Siemens SINAMICS GH150 V4.8 (Control Unit) <V4.8_SP2_HF9 Siemens SINAMICS GL150 V4.7 (Control Unit) Siemens SINAMICS GL150 V4.8 (Control Unit) <V4.8_SP2_HF9
    affected: fixed in V4.8, mitigation
  • Siemens SINAMICS GM150 V4.7 (Control Unit)
    affected: mitigation
  • Siemens SINAMICS GM150 V4.8 (Control Unit) <V4.8_SP2_HF9
    affected: fixed in V4.8, mitigation
  • Siemens SINAMICS SL150 V4.7 (Control Unit) <V4.7_HF33
    affected: fixed in V4.7, mitigation
  • Siemens SINAMICS SL150 V4.8 (Control Unit)
    affected: fixed in V5.2, mitigation
  • Siemens SINAMICS SM120 V4.7 (Control Unit) Siemens SINAMICS SM120 V4.8 (Control Unit) <V4.8_SP2_HF10
    affected: fixed in V4.8, mitigation
  • Siemens SINAMICS SM150 V4.8 (Control Unit)
    affected: fixed in V5.1, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5mo ago

Exploit prediction

1.40% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Siemens SIMATIC CP 1604
  • Siemens SIMATIC CP 1616
  • Siemens SIMATIC CP 343-1 Advanced
  • Siemens SIMATIC CP 443-1
  • Siemens SIMATIC CP 443-1 Advanced
  • Siemens SIMATIC CP 443-1 OPC UA
  • Siemens SIMATIC ET 200pro IM154-8 PN/DP CPU
  • Siemens SIMATIC ET 200pro IM154-8F PN/DP CPU
  • Siemens SIMATIC ET 200pro IM154-8FX PN/DP CPU
  • Siemens SIMATIC ET 200S IM151-8 PN/DP CPU
  • Siemens SIMATIC ET 200S IM151-8F PN/DP CPU
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
  • Siemens SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)
  • Siemens SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)
  • Siemens SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F
  • Siemens SIMATIC IPC DiagMonitor
  • Siemens SIMATIC RF182C
  • Siemens SIMATIC RF185C
  • Siemens SIMATIC RF186C
  • Siemens SIMATIC RF188C
  • Siemens SIMATIC RF600R family
  • Siemens SIMATIC RFID 181EIP
  • Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
  • Siemens SIMATIC S7-1500 Software Controller
  • Siemens SIMATIC S7-300 CPU 314C-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315F-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315T-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 317-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 317F-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 317T-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 319-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 319F-3 PN/DP
  • Siemens SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants)
  • Siemens SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)
  • Siemens SIMATIC S7-PLCSIM Advanced
  • Siemens SIMATIC Teleservice Adapter IE Advanced
  • Siemens SIMATIC Teleservice Adapter IE Basic
  • Siemens SIMATIC Teleservice Adapter IE Standard
  • Siemens SIMATIC WinAC RTX 2010
  • Siemens SIMATIC WinAC RTX F 2010
  • Siemens SIMATIC WinCC Runtime Advanced
  • Siemens SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants)
  • Siemens SIMOCODE pro V PROFINET (incl. SIPLUS variants)
  • Siemens SINAMICS G130 V4.6 Control Unit
  • Siemens SINAMICS G130 V4.7 Control Unit
  • Siemens SINAMICS G130 V4.7 SP1 Control Unit
  • Siemens SINAMICS G130 V4.8 Control Unit

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.