CVE-2019-10931

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-11 · updated 2026-06-17
Weakness: CWE-248

Description

A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions ), DIGSI 5 engineering software (All versions < V7.90), SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.90), SIPROTEC 5 device types 7SS85 and 7KE85 (All versions < V8.01), SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.59), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.59). Specially crafted packets sent to port 443/TCP could cause a Denial of Service condition.

Affected products

Siemens AG DIGSI 5 engineering software: before 7.90 — fixed in 7.90
Siemens Siprotec 5 Digsi Device Driver: before 7.90; before 8.01 — fixed in 7.90, 8.01

How to fix

Upgrade to a fixed version: Siemens AG DIGSI 5 engineering software 7.90; Siemens Siprotec 5 Digsi Device Driver 7.90, 8.01. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-10931 or the next vulnerability affects your stack