CVE-2019-10923

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-10 · updated 2026-06-17
Weakness: CWE-400

Description

An attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (IRT) of the affected installation.

Affected products

Siemens Cp1604 Firmware: before 2.8 — fixed in 2.8
Siemens Cp1616 Firmware: before 2.8 — fixed in 2.8
Siemens Dk Standard Ethernet Controller Firmware: before 4.1.1; 4.1.1, 4.1.1-p4 — fixed in 4.1.1
Siemens Ek-Ertec 200 Firmware: before 4.5.0; 4.5.0 — fixed in 4.5.0
Siemens Ek-Ertec 200P Firmware: before 4.5.0 — fixed in 4.5.0
Siemens Scalance X-200Irt Firmware: before 5.2.1 — fixed in 5.2.1
Siemens Simatic Et 200Ecopn Firmware: all versions
Siemens Simatic Et 200M Firmware: all versions
Siemens Simatic Et 200S Firmware: all versions
Siemens Simatic Pn/Pn Coupler 6Es7158-3Ad01-0Xa0 Firmware: all versions
Siemens Simatic S7-300 Cpu 312 Ifm Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-300 Cpu 313 Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-300 Cpu 314 Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-300 Cpu 314 Ifm Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-300 Cpu 315-2 Dp Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-300 Cpu 315 Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-300 Cpu 316-2 Dp Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-300 Cpu 318-2 Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-300 Cpu Firmware: before 3.3.17 — fixed in 3.3.17
Siemens Simatic S7-400 Dp V7 Firmware: all versions
Siemens Simatic S7-400 Pn V7 Firmware: all versions
Siemens Simatic S7-400 V6 Firmware: all versions
Siemens Simatic Winac Rtx (F) Firmware: before 2010; 2010, 2010-sp1, 2010-sp2 — fixed in 2010
Siemens Simotion Firmware: all versions
Siemens Sinamics Dcm Firmware: before 1.5; 1.5 — fixed in 1.5
Siemens Sinamics Dcp Firmware: before 1.3 — fixed in 1.3
Siemens Sinamics G110M Firmware: before 4.7; 4.7 — fixed in 4.7
Siemens Sinamics G120 Firmware: before 4.7; 4.7 — fixed in 4.7
Siemens Sinamics G130 Firmware: before 4.7; 4.7 — fixed in 4.7
Siemens Sinamics G150 Firmware: before 4.8 — fixed in 4.8

How to fix

Upgrade to a fixed version: Siemens Cp1604 Firmware 2.8; Siemens Cp1616 Firmware 2.8; Siemens Dk Standard Ethernet Controller Firmware 4.1.1; Siemens Ek-Ertec 200 Firmware 4.5.0; Siemens Ek-Ertec 200P Firmware 4.5.0; Siemens Scalance X-200Irt Firmware 5.2.1; Siemens Simatic S7-300 Cpu 312 Ifm Firmware 3.3.17; Siemens Simatic S7-300 Cpu 313 Firmware 3.3.17; Siemens Simatic S7-300 Cpu 314 Firmware 3.3.17; Siemens Simatic S7-300 Cpu 314 Ifm Firmware 3.3.17; Siemens Simatic S7-300 Cpu 315-2 Dp Firmware 3.3.17; Siemens Simatic S7-300 Cpu 315 Firmware 3.3.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-10923 or the next vulnerability affects your stack