Strix
26.1K

CVE-2019-13921

HIGHCVSS 7.5/10EPSS 1.37%

Last modified

CVE-2019-13921 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. EPSS estimates a 1.37% chance of exploitation in the next 30 days.

Description

A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
1.37%

68.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SiemensSimatic Winac Rtx \(F\) 2010All versions
SiemensSimatic Winac Rtx \(F\) 2010sp1
SiemensSimatic Winac Rtx \(F\) 2010sp2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-13921?
A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software.
How severe is CVE-2019-13921?
CVE-2019-13921 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.37% probability of exploitation in the next 30 days.
How do I fix CVE-2019-13921?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-13921?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST