● CVE — High
CVE-2019-13946
VendorsiemensProductscalance x-300 firmware, scalance xc-200 firmware, scalance xf-200 firmware, scalance xp-200 firmware, scalance x-200irt firmware, scalance xb-200 firmware, scalance xf-200ba firmware, scalance xr-300wg firmware, ek-ertec 200 firmware, ek-ertec 200p firmware, dk standard ethernet controller, profinet driver, ruggedcom rm1224 firmware, scalance m-800 firmware, scalance s615 firmware, scalance w700 ieee 802.11n firmware, scalance x-400 firmware, scalance xm-400 firmware, scalance xr524 firmware, scalance xr526 firmware, scalance xr528 firmware, scalance xr552 firmware, simatic cp 1604 firmware, simatic cp 1616 firmware, simatic ipc supportDiscoveredFeb 11, 2020UpdatedNov 21, 2024
Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.