CVE-2019-13939
Description
A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC00-U (All versions >= V2.3x and < V6.00.327), Desigo PXC001-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC100-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC12-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC128-U (All versions >= V2.3x and < V6.00.327), Desigo PXC200-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC36.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC50-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC64-U (All versions >= V2.3x and < V6.00.327), Desigo PXM20-E (All versions >= V2.3 < V6.0.327), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus Source Code (All versions), SIMOTICS CONNECT 400 (All versions < V0.3.0.330), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value.
How to fix
- siemens nucleus_readystart2017.02.2 or later
- siemens apogee_modular_equiment_controller_firmware2.8.2 or later
- siemens apogee_modular_building_controller_firmware2.8.2 or later
- siemens desigo_pxc00-e.d_firmware6.00.327 or later
- siemens desigo_pxc00-u_firmware6.00.327 or later
- siemens desigo_pxc001-e.d_firmware6.00.327 or later
- siemens desigo_pxc12-e.d_firmware6.00.327 or later
- siemens desigo_pxc22-e.d_firmware6.00.327 or later
- siemens desigo_pxc22.1-e.d_firmware6.00.327 or later
- siemens desigo_pxc36.1-e.d_firmware6.00.327 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens capital_vstar | No range specified | — |
| siemens nucleus_net | No range specified | — |
| siemens nucleus_readystart | v < 2017.02.2 | 2017.02.2 |
| siemens nucleus_safetycert | No range specified | — |
| siemens nucleus_source_code | No range specified | — |
| siemens nucleus_rtos | No range specified | — |
| siemens apogee_modular_equiment_controller_firmware | v < 2.8.2 | 2.8.2 |
| siemens apogee_modular_building_controller_firmware | v < 2.8.2 | 2.8.2 |
| siemens apogee_pxc_firmware | v ≤ 2.8.2 | — |
| siemens desigo_pxc_firmware | 2.3 ≤ v | — |
| siemens desigo_pxm20_firmware | 2.3 ≤ v | — |
| siemens simotics_connect_400_firmware | v ≤ 0.3.0.95 | — |
| siemens talon_tc_firmware | 3.0 ≤ v | — |
| siemens desigo_pxc00-e.d_firmware | 2.3.0 ≤ v < 6.00.327 | 6.00.327 |
| siemens desigo_pxc00-u_firmware | 2.3.0 ≤ v < 6.00.327 | 6.00.327 |
| siemens desigo_pxc001-e.d_firmware | 2.3.0 ≤ v < 6.00.327 | 6.00.327 |
| siemens desigo_pxc12-e.d_firmware | 2.3.0 ≤ v < 6.00.327 | 6.00.327 |
| siemens desigo_pxc22-e.d_firmware | 2.3.0 ≤ v < 6.00.327 | 6.00.327 |
| siemens desigo_pxc22.1-e.d_firmware | 2.3.0 ≤ v < 6.00.327 | 6.00.327 |
| siemens desigo_pxc36.1-e.d_firmware | 2.3.0 ≤ v < 6.00.327 | 6.00.327 |
| siemens desigopxc50-e.d_firmware | No range specified | — |
| siemens desigopxc64-u_firmware | No range specified | — |
| siemens desigopxc100-e.d_firmware | No range specified | — |
| siemens desigopxc128-u_firmware | No range specified | — |
| siemens desigopxc200-e.d_firmware | No range specified | — |
| siemens desigopxm20-e_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.