Read the docs
TI-2019-08155 Aliases CVE-2019-10935GHSA-3hg6-vvm5-64f6

Unrestricted file upload in Siemens SIMATIC PCS 7 V8.0 and earlier

Priority LOW 34CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd 11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC Professional (TIA Portal V13) (All versions), SIMATIC WinCC Professional (TIA Portal V14) (All versions < V14 SP1 Upd 9), SIMATIC WinCC Professional (TIA Portal V15) (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). The SIMATIC WinCC DataMonitor web application of the affected products allows to upload arbitrary ASPX code. The security vulnerability could be exploited by an authenticated attacker with network access to the WinCC DataMonitor application. No user interaction is required to exploit this vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the affected device. At the stage of publishing this security advisory no public exploitation is known.

Why it matters now

EPSS 0.01274 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC PCS 7 V8.0 and earlierAll versions—No fix listedCNA
SiemensSIMATIC PCS 7 V8.1All versions < V8.1 with WinCC V7.3 Upd 19—No fix listedCNA
SiemensSIMATIC PCS 7 V8.2All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd 11—No fix listedCNA
SiemensSIMATIC PCS 7 V9.0All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11—No fix listedCNA
SiemensSIMATIC WinCC Professional (TIA Portal V13)All versions—No fix listedCNA
SiemensSIMATIC WinCC Professional (TIA Portal V14)All versions < V14 SP1 Upd 9—No fix listedCNA
SiemensSIMATIC WinCC Professional (TIA Portal V15)All versions < V15.1 Upd 3—No fix listedCNA
SiemensSIMATIC WinCC Runtime Professional V13All versions—No fix listedCNA
SiemensSIMATIC WinCC Runtime Professional V14All versions < V14.1 Upd 8—No fix listedCNA
SiemensSIMATIC WinCC Runtime Professional V15All versions < V15.1 Upd 3—No fix listedCNA
SiemensSIMATIC WinCC V7.2 and earlierAll versions—No fix listedCNA
SiemensSIMATIC WinCC V7.3All versions < V7.3 Upd 19—No fix listedCNA
SiemensSIMATIC WinCC V7.4All versions < V7.4 SP1 Upd 11—No fix listedCNA
SiemensSIMATIC WinCC V7.5All versions < V7.5 Upd 3—No fix listedCNA
  • SIMATIC PCS 7 V8.0 and earlier VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V8.1 VendorSiemens Affected All versions < V8.1 with WinCC V7.3 Upd 19 Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V8.2 VendorSiemens Affected All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd 11 Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V9.0 VendorSiemens Affected All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11 Fixed in — No fix listed CNA
  • SIMATIC WinCC Professional (TIA Portal V13) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC Professional (TIA Portal V14) VendorSiemens Affected All versions < V14 SP1 Upd 9 Fixed in — No fix listed CNA
  • SIMATIC WinCC Professional (TIA Portal V15) VendorSiemens Affected All versions < V15.1 Upd 3 Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Professional V13 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Professional V14 VendorSiemens Affected All versions < V14.1 Upd 8 Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Professional V15 VendorSiemens Affected All versions < V15.1 Upd 3 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.2 and earlier VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.3 VendorSiemens Affected All versions < V7.3 Upd 19 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.4 VendorSiemens Affected All versions < V7.4 SP1 Upd 11 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected All versions < V7.5 Upd 3 Fixed in — No fix listed CNA

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_pcs_7:8.0:*:*:*:*:*:*:*8.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:*8.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*8.2VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:*9.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*up to 7.2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.3:-:*:*:*:*:*:*7.3VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.3:update_1:*:*:*:*:*:*7.3 update_1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.3:update_10:*:*:*:*:*:*7.3 update_10VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.3:update_11:*:*:*:*:*:*7.3 update_11VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.3:update_13:*:*:*:*:*:*7.3 update_13VulnerableSiemens
  • cpe:2.3:a:siemens:simatic_pcs_7:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:* Versions up to 7.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.3:-:*:*:*:*:*:* Versions 7.3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.3:update_1:*:*:*:*:*:* Versions 7.3 update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.3:update_10:*:*:*:*:*:* Versions 7.3 update_10 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.3:update_11:*:*:*:*:*:* Versions 7.3 update_11 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.3:update_13:*:*:*:*:*:* Versions 7.3 update_13 Vulnerable ·Siemens
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_wincc:7.3:update_4:*:*:*:*:*:*7.3 update_4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:-:*:*:*:*:*:*7.4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1:*:*:*:*:*:*7.4 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:update_1:*:*:*:*:*:*7.4 update_1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*7.5VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:13:-:*:*:professional:*:*:*13VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:13:sp2:*:*:professional:*:*:*13 sp2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:14:*:*:*:professional:*:*:*14VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:14:-:*:*:professional:*:*:*14VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:14:sp1:*:*:professional:*:*:*14 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:15:*:*:*:professional:*:*:*15VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:13:*:*:*:professional:*:*:*13VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:13:-:*:*:professional:*:*:*13VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:13:sp1:update_2:*:professional:*:*:*13 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:13:sp1:update_9:*:professional:*:*:*13 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:13:sp2:*:*:professional:*:*:*13 sp2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:14:-:*:*:professional:*:*:*14VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:14:sp1:*:*:professional:*:*:*14 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:15:-:*:*:professional:*:*:*15VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:15:update_4:*:*:professional:*:*:*15 update_4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:15.1:-:*:*:professional:*:*:*15.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime:15.1:update_1:*:*:professional:*:*:*15.1 update_1VulnerableSiemens
  • cpe:2.3:a:siemens:simatic_wincc:7.3:update_4:*:*:*:*:*:* Versions 7.3 update_4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:-:*:*:*:*:*:* Versions 7.4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1:*:*:*:*:*:* Versions 7.4 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:update_1:*:*:*:*:*:* Versions 7.4 update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:13:-:*:*:professional:*:*:* Versions 13 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:13:sp2:*:*:professional:*:*:* Versions 13 sp2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:14:*:*:*:professional:*:*:* Versions 14 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:14:-:*:*:professional:*:*:* Versions 14 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:14:sp1:*:*:professional:*:*:* Versions 14 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:15:*:*:*:professional:*:*:* Versions 15 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:13:*:*:*:professional:*:*:* Versions 13 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:13:-:*:*:professional:*:*:* Versions 13 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:13:sp1:update_2:*:professional:*:*:* Versions 13 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:13:sp1:update_9:*:professional:*:*:* Versions 13 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:13:sp2:*:*:professional:*:*:* Versions 13 sp2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:14:-:*:*:professional:*:*:* Versions 14 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:14:sp1:*:*:professional:*:*:* Versions 14 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:15:-:*:*:professional:*:*:* Versions 15 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:15:update_4:*:*:professional:*:*:* Versions 15 update_4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:15.1:-:*:*:professional:*:*:* Versions 15.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime:15.1:update_1:*:*:professional:*:*:* Versions 15.1 update_1 Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10935
  2. 2026-10-03 Alias added: GHSA-3hg6-vvm5-64f6

References

Patch 1

  • TI-2014-07026 The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3… CVSS 2.0HIGH 10.0
  • TI-2019-08143 Missing authentication in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1CRITICAL 9.8
  • TI-2023-11164 Code injection in Siemens SIMATIC PCS 7 CVSS 3.1CRITICAL 10.0
  • TI-2021-17429 Path traversal in Siemens SIMATIC PCS 7 V8.2 CVSS 3.1CRITICAL 9.9
  • TI-2019-08139 A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions)… CVSS 3.1HIGH 8.8
  • TI-2019-08137 SQL injection in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1HIGH 8.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences