Read the docs
TI-2019-08157 Aliases CVE-2019-10937GHSA-9jcm-qwpx-cpq2

Improper input validation in Siemens SIMATIC TDC CP51M1

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to the device could cause a Denial-of-Service condition by sending a specially crafted UDP packet. The vulnerability affects the UDP communication of the device. The security vulnerability could be exploited without authentication. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Why it matters now

EPSS 0.01279 70th percentileScored 2026-11-07
Fix Fixed SIMATIC TDC CP51M1 (Siemens AG): V1.1.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC TDC CP51M1before V1.1.7V1.1.7Patch availableCNA
  • SIMATIC TDC CP51M1 VendorSiemens Affected before V1.1.7 Fixed in V1.1.7 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:siemens:simatic_tdc_cp51m1_firmware:*:*:*:*:*:*:*:*before 1.1.7VulnerableSiemens
cpe:2.3:h:siemens:simatic_tdc_cp51m1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:simatic_tdc_cp51m1_firmware:*:*:*:*:*:*:*:* Versions before 1.1.7 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_tdc_cp51m1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

  • Fix · CNA SIMATIC TDC CP51M1 (Siemens AG) Fixed in V1.1.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10937
  2. 2026-10-03 Alias added: GHSA-9jcm-qwpx-cpq2

References

Patch 1

Other 1

  • TI-2019-13344 Uncontrolled resource consumption in Siemens SIMATIC S7-300 CPU family CVSS 3.1HIGH 7.5
  • TI-2022-09211 Uncontrolled resource consumption in Siemens SIMATIC CFU DIQ CVSS 3.1HIGH 7.5
  • TI-2019-13920 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 3.1HIGH 7.5
  • TI-2017-01922 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1
  • TI-2017-01923 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences