ICSA-19-134-08: ICSA-19-134-08 Siemens SIMATIC PCS7, WinCC, TIA Portal (Update D)

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2019-10916 · CWE-89

  An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.

• CVE-2019-10917 · CWE-248

  An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.

• CVE-2019-10918 · CWE-749

  An authenticatd attacker with network access to the DCOM interface could execute arbitrary commands with SYSTEM privileges. The vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires authentication with a low-privileged user account and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Acknowledgments, as the advisory lists them

• Vladimir Dashchenko, Sergey Temnikov, Kaspersky Lab ICS CERT: coordinating disclosure of vulnerability CVE-2019-10916 and CVE-2019-10917
• CNCERT/CC for: coordinating disclosure of vulnerability CVE-2019-10918
• ChengBin Wang, ZheJiang Guoli Security Technology: coordinating disclosure of vulnerability CVE-2019-10918

The advisory's legal notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.