Read the docs
TI-2019-08137 Aliases CVE-2019-10916GHSA-xw7x-jg7g-86qj

SQL injection in Siemens SIMATIC PCS 7 V8.0 and earlier

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Why it matters now

EPSS 0.01541 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC PCS 7 V8.0 and earlierAll versions—No fix listedCNA
SiemensSIMATIC PCS 7 V8.1All versions < V8.1 with WinCC V7.3 Upd 19—No fix listedCNA
SiemensSIMATIC PCS 7 V8.2All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11—No fix listedCNA
SiemensSIMATIC PCS 7 V9.0All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11—No fix listedCNA
SiemensSIMATIC WinCC (TIA Portal) V13All versions—No fix listedCNA
SiemensSIMATIC WinCC (TIA Portal) V14All versions < V14 SP1 Upd 9—No fix listedCNA
SiemensSIMATIC WinCC (TIA Portal) V15All versions < V15.1 Upd 3—No fix listedCNA
SiemensSIMATIC WinCC Runtime Professional V13All versions—No fix listedCNA
SiemensSIMATIC WinCC Runtime Professional V14All versions < V14.1 Upd 8—No fix listedCNA
SiemensSIMATIC WinCC Runtime Professional V15All versions < V15.1 Upd 3—No fix listedCNA
SiemensSIMATIC WinCC V7.2 and earlierAll versions—No fix listedCNA
SiemensSIMATIC WinCC V7.3All versions < V7.3 Upd 19—No fix listedCNA
SiemensSIMATIC WinCC V7.4All versions < V7.4 SP1 Upd 11—No fix listedCNA
SiemensSIMATIC WinCC V7.5All versions < V7.5 Upd 3—No fix listedCNA
  • SIMATIC PCS 7 V8.0 and earlier VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V8.1 VendorSiemens Affected All versions < V8.1 with WinCC V7.3 Upd 19 Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V8.2 VendorSiemens Affected All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11 Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V9.0 VendorSiemens Affected All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11 Fixed in — No fix listed CNA
  • SIMATIC WinCC (TIA Portal) V13 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC (TIA Portal) V14 VendorSiemens Affected All versions < V14 SP1 Upd 9 Fixed in — No fix listed CNA
  • SIMATIC WinCC (TIA Portal) V15 VendorSiemens Affected All versions < V15.1 Upd 3 Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Professional V13 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Professional V14 VendorSiemens Affected All versions < V14.1 Upd 8 Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Professional V15 VendorSiemens Affected All versions < V15.1 Upd 3 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.2 and earlier VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.3 VendorSiemens Affected All versions < V7.3 Upd 19 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.4 VendorSiemens Affected All versions < V7.4 SP1 Upd 11 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected All versions < V7.5 Upd 3 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*up to 8.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:*8.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*8.2VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:*9.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*up to 7.2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:*7.3VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*7.4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*7.5VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):13.0:*:*:*:*:*:*:*13.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):14.0:*:*:*:*:*:*:*14.0VulnerableSiemens
  • cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:* Versions up to 8.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:* Versions up to 7.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Siemens
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):15.0:*:*:*:*:*:*:*15.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
  • cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10916
  2. 2026-10-03 Alias added: GHSA-xw7x-jg7g-86qj

References

Advisory 2

  • TI-2014-07026 The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3… CVSS 2.0HIGH 10.0
  • TI-2019-08143 Missing authentication in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1CRITICAL 9.8
  • TI-2023-11164 Code injection in Siemens SIMATIC PCS 7 CVSS 3.1CRITICAL 10.0
  • TI-2021-17429 Path traversal in Siemens SIMATIC PCS 7 V8.2 CVSS 3.1CRITICAL 9.9
  • TI-2019-08139 A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions)… CVSS 3.1HIGH 8.8
  • TI-2021-17431 Information disclosure in Siemens SIMATIC PCS 7 V8.2 CVSS 3.1HIGH 8.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences