Skip to content
Fencer Intel
high 7.5

CVE-2019-6575 json

A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl.

published 7y ago modified 4mo ago also EUVD-2019-16134

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V2.7), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) (All versions < V15.1 Upd 4), SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) (All versions < V15.1 Upd 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Upd 4), SIMATIC IPC DiagMonitor (All versions < V5.1.3), SIMATIC NET PC Software V13 (All versions), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC RF188C (All versions < V1.1.0), SIMATIC RF600R family (All versions < V3.2.1), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.5 < V2.6.1), SIMATIC S7-1500 Software Controller (All versions between V2.5 (including) and V2.7 (excluding)), SIMATIC WinCC OA (All versions < V3.15 P018), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Upd 4), SINEC NMS (All versions < V1.0 SP1), SINEMA Server (All versions < V14 SP2), SINUMERIK OPC UA Server (All versions < V2.1), TeleControl Server Basic (All versions < V3.1.1). Specially crafted network packets sent to affected devices on port 4840/tcp could allow an unauthenticated remote attacker to cause a denial of service condition of the OPC communication or crash the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the OPC communication.

Patch / fix

  • siemens simatic_wincc_oa 3.15-p018
  • siemens sinec-nms 1.0
  • siemens sinumerik_opc_ua_server 2.1
  • siemens telecontrol_server_basic 3.1.1
  • siemens simatic_et_200_open_controller_cpu_1515sp_pc2_firmware 2.7
  • siemens simatic_hmi_comfort_outdoor_panels_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp400f_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp900_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp700f_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp700_firmware 15.1
  • siemens simatic_hmi_ktp_mobile_panels_ktp900f_firmware 15.1

Is CVE-2019-6575 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-134-09 updated cvss 7.5

Siemens SIMATIC Panels and WinCC (TIA Portal)

  • Siemens SIMATIC CP 443-1 OPC UA
    affected: mitigation, no fix planned
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) <V2.7
    affected: fixed in V2.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) <V15.1_Upd_4 Siemens SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) <V15.1_Upd_4 Siemens SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F <V15.1_Upd_4
    affected: fixed in V15.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC IPC DiagMonitor <V5.1.3
    affected: fixed in V5.1.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC NET PC Software V13
    affected: mitigation, no fix planned
  • Siemens SIMATIC NET PC Software V14 <V14_SP1_Update_14
    affected: fixed in V14, mitigation support.industry.siemens.com
  • Siemens SIMATIC NET PC Software V15
    affected: mitigation, no fix planned
  • Siemens SIMATIC RF188C <V1.1.0
    affected: fixed in V1.1.0, mitigation support.industry.siemens.com
show 9 more

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-19-099-03 updated cvss 7.5

Siemens Industrial Products with OPC UA (Update H)

  • Siemens SIMATIC CP 443-1 OPC UA
    affected: mitigation, no fix planned “Deactivate the OPC UA Service if supported by the product”
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) < V2.7
    affected: fixed in V2.7, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) < V15.1 Upd 4 Siemens SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) < V15.1 Upd 4 Siemens SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F < V15.1 Upd 4
    affected: fixed in V15.1, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SIMATIC IPC DiagMonitor < V5.1.3
    affected: fixed in V5.1.3, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SIMATIC NET PC Software V13
    affected: mitigation, no fix planned “Deactivate the OPC UA Service if supported by the product”
  • Siemens SIMATIC NET PC Software V14 < V14 SP1 Update 14
    affected: fixed in V14, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SIMATIC NET PC Software V15
    affected: mitigation, no fix planned “Deactivate the OPC UA Service if supported by the product”
  • Siemens SIMATIC RF188C < V1.1.0
    affected: fixed in V1.1.0, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
show 9 more
  • Siemens SIMATIC RF600R family < V3.2.1
    affected: fixed in V3.2.1, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) >= V2.5 < V2.6.1
    affected: fixed in V2.6.1, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SIMATIC S7-1500 Software Controller All versions between V2.5 (including) and V2.7 (excluding)
    affected: fixed in V2.7, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SIMATIC WinCC OA < V3.15 P018
    affected: fixed in V3.15, mitigation “Deactivate the OPC UA Service if supported by the product” winccoa.com
  • Siemens SIMATIC WinCC Runtime Advanced < V15.1 Upd 4
    affected: fixed in V15.1, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SINEC NMS < V1.0 SP1
    affected: fixed in V1.0, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SINEMA Server < V14 SP2
    affected: fixed in V14, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens SINUMERIK OPC UA Server < V2.1
    affected: fixed in V2.1, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com
  • Siemens TeleControl Server Basic < V3.1.1
    affected: fixed in V3.1.1, mitigation “Deactivate the OPC UA Service if supported by the product” support.industry.siemens.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5mo ago

Exploit prediction

1.68% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • Siemens SIMATIC CP 443-1 OPC UA
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
  • Siemens SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)
  • Siemens SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)
  • Siemens SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F
  • Siemens SIMATIC IPC DiagMonitor
  • Siemens SIMATIC NET PC Software V13
  • Siemens SIMATIC NET PC Software V14
  • Siemens SIMATIC NET PC Software V15
  • Siemens SIMATIC RF188C
  • Siemens SIMATIC RF600R family
  • Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
  • Siemens SIMATIC S7-1500 Software Controller
  • Siemens SIMATIC WinCC OA
  • Siemens SIMATIC WinCC Runtime Advanced
  • Siemens SINEC NMS
  • Siemens SINEMA Server
  • Siemens SINUMERIK OPC UA Server
  • Siemens TeleControl Server Basic

Classification

Weakness
  • CWE-248 Uncaught Exception
  • CWE-755 Improper Handling of Exceptional Conditions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.