Skip to content
Fencer Vulns
critical 9.8

CVE-2019-10938 json

A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU varia…

published 2019-08-02 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-2652

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions < V8.01), Siemens Power Meters Series 9410 (All versions < V2.2.1), Siemens Power Meters Series 9810 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device. At the time of advisory publication no public exploitation of this security vulnerability was known.

Patch / fix

Exploit prediction

1.49% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Siemens AG SIPROTEC 5 devices with CPU variants CP200
  • Siemens AG SIPROTEC 5 devices with CPU variants CP300 and CP100
  • Siemens AG Siemens Power Meters Series 9410
  • Siemens AG Siemens Power Meters Series 9810

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.