Read the docs
TI-2019-13902 Aliases CVE-2019-19282GHSA-2pg9-8888-cqmc

A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All…

Priority LOW 36CWE-131Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-131 and the CVSS impact.

Summary

A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd3), SIMATIC BATCH V8.1 (All versions), SIMATIC BATCH V8.2 (All versions < V8.2 Upd12), SIMATIC BATCH V9.0 (All versions < V9.0 SP1 Upd5), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 1), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC Route Control V8.1 (All versions), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions < V9.0 Upd4), SIMATIC WinCC (TIA Portal) V13 (All versions < V13 SP2), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC (TIA Portal) V15.1 (All versions < V15.1 Update 5), SIMATIC WinCC (TIA Portal) V16 (All versions < V16 Update 1), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 1). Through specially crafted messages, when encrypted communication is enabled, an attacker with network access could use the vulnerability to compromise the availability of the system by causing a Denial-of-Service condition. Successful exploitation requires no system privileges and no user interaction.

Why it matters now

EPSS 0.01344 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensOpenPCS 7 V8.1All versions—No fix listedCNA
SiemensOpenPCS 7 V8.2All versions—No fix listedCNA
SiemensOpenPCS 7 V9.0All versions < V9.0 Upd3—No fix listedCNA
SiemensSIMATIC BATCH V8.1All versions—No fix listedCNA
SiemensSIMATIC BATCH V8.2All versions < V8.2 Upd12—No fix listedCNA
SiemensSIMATIC BATCH V9.0All versions < V9.0 SP1 Upd5—No fix listedCNA
SiemensSIMATIC NET PC Software V14All versions < V14 SP1 Update 14—No fix listedCNA
SiemensSIMATIC NET PC Software V15All versions—No fix listedCNA
SiemensSIMATIC NET PC Software V16All versions < V16 Update 1—No fix listedCNA
SiemensSIMATIC PCS 7 V8.1All versions—No fix listedCNA
SiemensSIMATIC PCS 7 V8.2All versions—No fix listedCNA
SiemensSIMATIC PCS 7 V9.0All versions < V9.0 SP3—No fix listedCNA
SiemensSIMATIC Route Control V8.1All versions—No fix listedCNA
SiemensSIMATIC Route Control V8.2All versions—No fix listedCNA
SiemensSIMATIC Route Control V9.0All versions < V9.0 Upd4—No fix listedCNA
SiemensSIMATIC WinCC (TIA Portal) V13All versions < V13 SP2—No fix listedCNA
SiemensSIMATIC WinCC (TIA Portal) V14All versions < V14 SP1 Update 10—No fix listedCNA
SiemensSIMATIC WinCC (TIA Portal) V15.1All versions < V15.1 Update 5—No fix listedCNA
SiemensSIMATIC WinCC (TIA Portal) V16All versions < V16 Update 1—No fix listedCNA
SiemensSIMATIC WinCC V7.3All versions—No fix listedCNA
SiemensSIMATIC WinCC V7.4All versions < V7.4 SP1 Update 14—No fix listedCNA
SiemensSIMATIC WinCC V7.5All versions < V7.5 SP1 Update 1—No fix listedCNA
  • OpenPCS 7 V8.1 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • OpenPCS 7 V8.2 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • OpenPCS 7 V9.0 VendorSiemens Affected All versions < V9.0 Upd3 Fixed in — No fix listed CNA
  • SIMATIC BATCH V8.1 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC BATCH V8.2 VendorSiemens Affected All versions < V8.2 Upd12 Fixed in — No fix listed CNA
  • SIMATIC BATCH V9.0 VendorSiemens Affected All versions < V9.0 SP1 Upd5 Fixed in — No fix listed CNA
  • SIMATIC NET PC Software V14 VendorSiemens Affected All versions < V14 SP1 Update 14 Fixed in — No fix listed CNA
  • SIMATIC NET PC Software V15 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC NET PC Software V16 VendorSiemens Affected All versions < V16 Update 1 Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V8.1 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V8.2 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V9.0 VendorSiemens Affected All versions < V9.0 SP3 Fixed in — No fix listed CNA
  • SIMATIC Route Control V8.1 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC Route Control V8.2 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC Route Control V9.0 VendorSiemens Affected All versions < V9.0 Upd4 Fixed in — No fix listed CNA
  • SIMATIC WinCC (TIA Portal) V13 VendorSiemens Affected All versions < V13 SP2 Fixed in — No fix listed CNA
  • SIMATIC WinCC (TIA Portal) V14 VendorSiemens Affected All versions < V14 SP1 Update 10 Fixed in — No fix listed CNA
  • SIMATIC WinCC (TIA Portal) V15.1 VendorSiemens Affected All versions < V15.1 Update 5 Fixed in — No fix listed CNA
  • SIMATIC WinCC (TIA Portal) V16 VendorSiemens Affected All versions < V16 Update 1 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.3 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.4 VendorSiemens Affected All versions < V7.4 SP1 Update 14 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected All versions < V7.5 SP1 Update 1 Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:siemens:openpcs_7:9.0:-:*:*:*:*:*:*9.0VulnerableSiemens
cpe:2.3:a:siemens:openpcs_7:9.0_update_1:*:*:*:*:*:*:*9.0_update_1VulnerableSiemens
cpe:2.3:a:siemens:simatic_batch:9.0:-:*:*:*:*:*:*9.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_batch:9.0:sp1:*:*:*:*:*:*9.0 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_batch:9.0:sp1_update_1:*:*:*:*:*:*9.0 sp1_update_1VulnerableSiemens
cpe:2.3:a:siemens:simatic_batch:9.0:sp1_update_2:*:*:*:*:*:*9.0 sp1_update_2VulnerableSiemens
cpe:2.3:a:siemens:simatic_batch:9.0:sp1_update_3:*:*:*:*:*:*9.0 sp1_update_3VulnerableSiemens
cpe:2.3:a:siemens:simatic_batch:9.0:sp1_update_4:*:*:*:*:*:*9.0 sp1_update_4VulnerableSiemens
cpe:2.3:a:siemens:simatic_net_pc:*:*:*:*:*:*:*:*before 16VulnerableSiemens
cpe:2.3:a:siemens:simatic_net_pc:16:-:*:*:*:*:*:*16VulnerableSiemens
  • cpe:2.3:a:siemens:openpcs_7:9.0:-:*:*:*:*:*:* Versions 9.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:openpcs_7:9.0_update_1:*:*:*:*:*:*:* Versions 9.0_update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_batch:9.0:-:*:*:*:*:*:* Versions 9.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_batch:9.0:sp1:*:*:*:*:*:* Versions 9.0 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_batch:9.0:sp1_update_1:*:*:*:*:*:* Versions 9.0 sp1_update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_batch:9.0:sp1_update_2:*:*:*:*:*:* Versions 9.0 sp1_update_2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_batch:9.0:sp1_update_3:*:*:*:*:*:* Versions 9.0 sp1_update_3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_batch:9.0:sp1_update_4:*:*:*:*:*:* Versions 9.0 sp1_update_4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_net_pc:*:*:*:*:*:*:*:* Versions before 16 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_net_pc:16:-:*:*:*:*:*:* Versions 16 Vulnerable ·Siemens
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:*8.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*8.2VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:9.0:-:*:*:*:*:*:*9.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:9.0:sp1:*:*:*:*:*:*9.0 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:9.0:sp2:*:*:*:*:*:*9.0 sp2VulnerableSiemens
cpe:2.3:a:siemens:simatic_route_control:*:*:*:*:*:*:*:*before 9.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_route_control:9.0:-:*:*:*:*:*:*9.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:-:*:*:*:*:*:*7.4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1:*:*:*:*:*:*7.4 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_1:*:*:*:*:*:*7.4 sp1_update_1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_10:*:*:*:*:*:*7.4 sp1_update_10VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_11:*:*:*:*:*:*7.4 sp1_update_11VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_12:*:*:*:*:*:*7.4 sp1_update_12VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_13:*:*:*:*:*:*7.4 sp1_update_13VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_2:*:*:*:*:*:*7.4 sp1_update_2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_3:*:*:*:*:*:*7.4 sp1_update_3VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_4:*:*:*:*:*:*7.4 sp1_update_4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_5:*:*:*:*:*:*7.4 sp1_update_5VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_6:*:*:*:*:*:*7.4 sp1_update_6VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_7:*:*:*:*:*:*7.4 sp1_update_7VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_8:*:*:*:*:*:*7.4 sp1_update_8VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_9:*:*:*:*:*:*7.4 sp1_update_9VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:-:*:*:*:*:*:*7.5VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:sp1:-:*:*:*:*:*7.5 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5.1:-:*:*:*:*:*:*7.5.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:13:-:*:*:*:*:*:*13VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:13:sp1:*:*:*:*:*:*13 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:14.0.1:*:*:*:*:*:*:*14.0.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:15.1:-:*:*:*:*:*:*15.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:15.1:update_1:*:*:*:*:*:*15.1 update_1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:15.1:update_2:*:*:*:*:*:*15.1 update_2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:15.1:update_3:*:*:*:*:*:*15.1 update_3VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:15.1:update_4:*:*:*:*:*:*15.1 update_4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:16:-:*:*:*:*:*:*16VulnerableSiemens
  • cpe:2.3:a:siemens:simatic_pcs_7:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:9.0:-:*:*:*:*:*:* Versions 9.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:9.0:sp1:*:*:*:*:*:* Versions 9.0 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:9.0:sp2:*:*:*:*:*:* Versions 9.0 sp2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_route_control:*:*:*:*:*:*:*:* Versions before 9.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_route_control:9.0:-:*:*:*:*:*:* Versions 9.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:-:*:*:*:*:*:* Versions 7.4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1:*:*:*:*:*:* Versions 7.4 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_1:*:*:*:*:*:* Versions 7.4 sp1_update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_10:*:*:*:*:*:* Versions 7.4 sp1_update_10 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_11:*:*:*:*:*:* Versions 7.4 sp1_update_11 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_12:*:*:*:*:*:* Versions 7.4 sp1_update_12 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_13:*:*:*:*:*:* Versions 7.4 sp1_update_13 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_2:*:*:*:*:*:* Versions 7.4 sp1_update_2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_3:*:*:*:*:*:* Versions 7.4 sp1_update_3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_4:*:*:*:*:*:* Versions 7.4 sp1_update_4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_5:*:*:*:*:*:* Versions 7.4 sp1_update_5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_6:*:*:*:*:*:* Versions 7.4 sp1_update_6 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_7:*:*:*:*:*:* Versions 7.4 sp1_update_7 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_8:*:*:*:*:*:* Versions 7.4 sp1_update_8 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update_9:*:*:*:*:*:* Versions 7.4 sp1_update_9 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:-:*:*:*:*:*:* Versions 7.5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp1:-:*:*:*:*:* Versions 7.5 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5.1:-:*:*:*:*:*:* Versions 7.5.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:13:-:*:*:*:*:*:* Versions 13 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:13:sp1:*:*:*:*:*:* Versions 13 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:14.0.1:*:*:*:*:*:*:* Versions 14.0.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:15.1:-:*:*:*:*:*:* Versions 15.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:15.1:update_1:*:*:*:*:*:* Versions 15.1 update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:15.1:update_2:*:*:*:*:*:* Versions 15.1 update_2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:15.1:update_3:*:*:*:*:*:* Versions 15.1 update_3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:15.1:update_4:*:*:*:*:*:* Versions 15.1 update_4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:16:-:*:*:*:*:*:* Versions 16 Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19282
  2. 2026-10-03 Alias added: GHSA-2pg9-8888-cqmc

References

Advisory 1

  • TI-2018-03409 Improper input validation in Siemens OpenPCS 7 V7.1 and earlier CVSS 3.1HIGH 7.5
  • TI-2023-26225 NULL pointer dereference in Siemens OpenPCS 7 V9.1 CVSS 4.0HIGH 7.1
  • TI-2023-26224 NULL pointer dereference in Siemens OpenPCS 7 V9.1 CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences