CVE-2019-10935

A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd 11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC Professional (TIA Portal V13) (All versions), SIMATIC WinCC Professional (TIA Portal V14) (All versions < V14 SP1 Upd 9), SIMATIC WinCC Professional (TIA Portal V15) (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). The SIMATIC WinCC DataMonitor web application of the affected products allows to upload arbitrary ASPX code. The security vulnerability could be exploited by an authenticated attacker with network access to the WinCC DataMonitor application. No user interaction is required to exploit this vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the affected device. At the stage of publishing this security advisory no public exploitation is known.

• CWE-434
• CWE-434

• https://cert-portal.siemens.com/productcert/pdf/ssa-121293.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-121293.pdfPatch, Vendor Advisory

Published

Jul 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10929A vulnerability has been identified in SIMATIC CP 1626 (All …5.9
• CVE-2019-1093An information disclosure vulnerability exists when DirectWr…
• CVE-2019-10930A vulnerability has been identified in All other SIPROTEC 5 …
• CVE-2019-10931A vulnerability has been identified in All other SIPROTEC 5 …7.5
• CVE-2019-10933A vulnerability has been identified in Spectrum Power 3 (Cor…
• CVE-2019-10934A vulnerability has been identified in TIA Portal V14 (All v…7.8
• CVE-2019-10936Affected devices improperly handle large amounts of speciall…7.5
• CVE-2019-10937A vulnerability has been identified in SIMATIC TDC CP51M1 (A…7.5
• CVE-2019-10938A vulnerability has been identified in SIPROTEC 5 devices wi…9.8
• CVE-2019-10939A vulnerability has been identified in TIM 3V-IE (incl. SIPL…9.8
• CVE-2019-1094An information disclosure vulnerability exists when the Wind…
• CVE-2019-10940A vulnerability has been identified in SINEMA Server (All ve…9.9