Skip to content
Fencer Vulns
high 7.5

CVE-2019-19282 json

A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Up…

published 2020-03-10 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-8906

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd3), SIMATIC BATCH V8.1 (All versions), SIMATIC BATCH V8.2 (All versions < V8.2 Upd12), SIMATIC BATCH V9.0 (All versions < V9.0 SP1 Upd5), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 1), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC Route Control V8.1 (All versions), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions < V9.0 Upd4), SIMATIC WinCC (TIA Portal) V13 (All versions < V13 SP2), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC (TIA Portal) V15.1 (All versions < V15.1 Update 5), SIMATIC WinCC (TIA Portal) V16 (All versions < V16 Update 1), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 1). Through specially crafted messages, when encrypted communication is enabled, an attacker with network access could use the vulnerability to compromise the availability of the system by causing a Denial-of-Service condition. Successful exploitation requires no system privileges and no user interaction.

Patch / fix

  • siemens simatic_net_pc 16
  • siemens simatic_route_control 9.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-042-06 updated cvss 7.5

Siemens SIMATIC PCS 7, SIMATIC WinCC, and SIMATIC NET PC (Update G)

  • Siemens OpenPCS 7 V8.1 Siemens OpenPCS 7 V8.2
    affected: mitigation, no fix planned
  • Siemens OpenPCS 7 V9.0 <V9.0_Upd3
    affected: vendor fix, mitigation
  • Siemens SIMATIC BATCH V8.1
    affected: mitigation, no fix planned
  • Siemens SIMATIC BATCH V8.2 <vers:/_V8.2_Upd12
    affected: fixed in V8.2, mitigation support.industry.siemens.com
  • Siemens SIMATIC BATCH V9.0 <V9.0_SP1_Upd5
    affected: vendor fix, mitigation
  • Siemens SIMATIC NET PC Software V14 <V14_SP1_Update_14
    affected: fixed in V14, mitigation support.industry.siemens.com
  • Siemens SIMATIC NET PC Software V15
    affected: mitigation, no fix planned
  • Siemens SIMATIC NET PC Software V16 <V16_Update_1
    affected: fixed in V16, mitigation support.industry.siemens.com
show 12 more
  • Siemens SIMATIC PCS 7 V8.1
    affected: mitigation, no fix planned
  • Siemens SIMATIC PCS 7 V8.2
    affected: fixed in V8.2, mitigation support.industry.siemens.com
  • Siemens SIMATIC PCS 7 V9.0 <V9.0_SP3
    affected: fixed in V9.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC Route Control V8.1 Siemens SIMATIC Route Control V8.2
    affected: mitigation, no fix planned
  • Siemens SIMATIC Route Control V9.0 <V9.0_Upd4
    affected: vendor fix, mitigation
  • Siemens SIMATIC WinCC (TIA Portal) V13 <V13_SP2
    affected: fixed in V13, mitigation support.industry.siemens.com
  • Siemens SIMATIC WinCC (TIA Portal) V14 <V14_SP1_Update_10
    affected: fixed in V14, mitigation support.industry.siemens.com
  • Siemens SIMATIC WinCC (TIA Portal) V15.1 <V15.1_Update_5
    affected: fixed in V15.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC WinCC (TIA Portal) V16 <V16_Update_1
    affected: fixed in V16, mitigation support.industry.siemens.com
  • Siemens SIMATIC WinCC V7.3
    affected: mitigation, no fix planned
  • Siemens SIMATIC WinCC V7.4 <V7.4_SP1_Update_14
    affected: fixed in V7.4, mitigation support.industry.siemens.com
  • Siemens SIMATIC WinCC V7.5 <V7.5_SP1_Update_1
    affected: fixed in V7.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C

Affected products

  • Siemens OpenPCS 7 V8.1
  • Siemens OpenPCS 7 V8.2
  • Siemens OpenPCS 7 V9.0
  • Siemens SIMATIC BATCH V8.1
  • Siemens SIMATIC BATCH V8.2
  • Siemens SIMATIC BATCH V9.0
  • Siemens SIMATIC NET PC Software V14
  • Siemens SIMATIC NET PC Software V15
  • Siemens SIMATIC NET PC Software V16
  • Siemens SIMATIC PCS 7 V8.1
  • Siemens SIMATIC PCS 7 V8.2
  • Siemens SIMATIC PCS 7 V9.0
  • Siemens SIMATIC Route Control V8.1
  • Siemens SIMATIC Route Control V8.2
  • Siemens SIMATIC Route Control V9.0
  • Siemens SIMATIC WinCC (TIA Portal) V13
  • Siemens SIMATIC WinCC (TIA Portal) V14
  • Siemens SIMATIC WinCC (TIA Portal) V15.1
  • Siemens SIMATIC WinCC (TIA Portal) V16
  • Siemens SIMATIC WinCC V7.3
  • Siemens SIMATIC WinCC V7.4
  • Siemens SIMATIC WinCC V7.5

Classification

Weakness
  • CWE-131 Incorrect Calculation of Buffer Size

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.