Read the docs
TI-2019-10377 Aliases CVE-2019-13921GHSA-rf96-4cxg-vq3q

Uncontrolled resource consumption in Siemens SIMATIC WinAC RTX 2010

Priority LOW 36CWE-410Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software.

Why it matters now

EPSS 0.01367 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC WinAC RTX (F) 2010All versions < SP3 Update 1—No fix listedCNA
  • SIMATIC WinAC RTX (F) 2010 VendorSiemens Affected All versions < SP3 Update 1 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:-:update_1:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:-:update_2:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:-:update_3:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp1:*:*:*:*:*:*:*sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:-:*:*:*:*:*:*sp2VulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:update_1:*:*:*:*:*:*sp2 update_1VulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:update_2:*:*:*:*:*:*sp2 update_2VulnerableSiemens
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:update_3:*:*:*:*:*:*sp2 update_3VulnerableSiemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:-:update_1:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:-:update_2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:-:update_3:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp1:*:*:*:*:*:*:* Versions sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:-:*:*:*:*:*:* Versions sp2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:update_1:*:*:*:*:*:* Versions sp2 update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:update_2:*:*:*:*:*:* Versions sp2 update_2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:update_3:*:*:*:*:*:* Versions sp2 update_3 Vulnerable ·Siemens
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:update_4:*:*:*:*:*:*sp2 update_4VulnerableSiemens
  • cpe:2.3:a:siemens:simatic_winac_rtx_\(f\)_2010:sp2:update_4:*:*:*:*:*:* Versions sp2 update_4 Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13921
  2. 2026-10-03 Alias added: GHSA-rf96-4cxg-vq3q

References

Advisory 1

  • TI-2019-10393 Uncontrolled resource consumption in Siemens SIMATIC ET 200pro IM154-8 PN/DP CPU CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences