What’s Vulnerable › Vulnerabilities
CVE-2019-10953
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-04-17 · updated 2026-06-17
- Weakness: CWE-400
Description
ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets.
Affected products
- ABB Pm554-Tp-Eth Firmware: all versions
- Phoenixcontact Ilc 151 Eth Firmware: all versions
- Modicon M221, all references, all versions: before 1.10.0.0 — fixed in 1.10.0.0
- Siemens 6Ed1052-1Cc01-0Ba8 Firmware: all versions
- Siemens 6Es7211-1Ae40-0Xb0 Firmware: all versions
- Siemens 6Es7314-6Eh04-0Ab0 Firmware: all versions
- WAGO Bacnet/Ip Firmware: all versions
- WAGO Ethernet Firmware: all versions
- WAGO Knx Ip Firmware: all versions
- WAGO Pfc100 Firmware: all versions
How to fix
Upgrade to a fixed version: Modicon M221, all references, all versions 1.10.0.0. Check the vendor advisory for mitigations.
References
- http://www.securityfocus.com/bid/108413
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2019/icsa-19-106-03.json
- https://ics-cert.us-cert.gov/advisories/ICSA-19-106-03
- http://www.securityfocus.com/bid/108413
- https://ics-cert.us-cert.gov/advisories/ICSA-19-106-03
Get alerted when CVE-2019-10953 or the next vulnerability affects your stack