Skip to content
Fencer Vulns
medium 5.6

CVE-2019-1125 json

Windows Kernel Information Disclosure Vulnerability

published 2019-09-03 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-9702

cvss
5.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.5%
EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits
1
Exploit-DB

Summary

An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly, but it could be used to obtain information that could be used to try to compromise the affected system further. On January 3, 2018, Microsoft released an advisory and security updates related to a newly-discovered class of hardware vulnerabilities (known as Spectre) involving speculative execution side channels that affect AMD, ARM, and Intel CPUs to varying degrees. This vulnerability, released on August 6, 2019, is a variant of the Spectre Variant 1 speculative execution side channel vulnerability and has been assigned CVE-2019-1125. Microsoft released a security update on July 9, 2019 that addresses the vulnerability through a software change that mitigates how the CPU speculatively accesses memory. Note that this vulnerability does not require a microcode update from your device OEM.

Patch / fix

  • linux Debian 14, Debian 13, Debian 12 5.2.7-1

debian advisories DEBIAN-CVE-2019-1125

  • linux Ubuntu 16.04 LTS 4.4.0-159.187
  • linux Ubuntu 18.04 LTS 4.15.0-58.64
  • linux-aws Ubuntu 16.04 LTS 4.4.0-1090.101
  • linux-aws Ubuntu 18.04 LTS 4.15.0-1045.47
  • linux-gcp Ubuntu 16.04 LTS 4.15.0-1040.42~16.04.1
  • linux-gcp Ubuntu 18.04 LTS 4.15.0-1040.42
  • linux-hwe Ubuntu 16.04 LTS 4.15.0-58.64~16.04.1
  • linux-hwe Ubuntu 18.04 LTS 5.0.0-25.26~18.04.1

ubuntu advisories UBUNTU-CVE-2019-1125

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perf RHEL 7.6 EUS, RHEL 7 3.10.0-957.38.1.el7
  • python-perf RHEL 7.6 EUS, RHEL 7 3.10.0-957.38.1.el7
  • kernel RHEL 7 3.10.0-1062.1.1.el7
  • perf RHEL 7 3.10.0-1062.1.1.el7
  • bpftool RHEL 7 3.10.0-1062.1.1.el7
  • python-perf RHEL 7 3.10.0-1062.1.1.el7
  • kernel-kdump RHEL 7 3.10.0-1062.1.1.el7
  • kernel-tools RHEL 7 3.10.0-1062.1.1.el7

red hat advisories RHSA-2019:3220RHSA-2019:2975RHSA-2019:2600RHSA-2019:2609RHSA-2019:3011RHSA-2019:2900

  • kernel-rt SLE Real Time 12 SP4 4.12.14-8.3.1
  • kernel-syms-rt SLE Real Time 12 SP4 4.12.14-8.3.1
  • kernel-rt_debug SLE Real Time 12 SP4 4.12.14-8.3.1
  • kernel-source-rt SLE Real Time 12 SP4 4.12.14-8.3.1
  • kernel-source-rt Real Time Module 15 SP1 4.12.14-14.8.1
  • kernel-rt Real Time Module 15 SP1 4.12.14-14.8.1
  • kernel-syms-rt Real Time Module 15 SP1 4.12.14-14.8.1
  • kernel-rt_debug Real Time Module 15 SP1 4.12.14-14.8.1

suse advisories SUSE-SU-2019:2450-1SUSE-SU-2019:2430-1SUSE-SU-2019:2299-1SUSE-SU-2019:2263-1SUSE-SU-2019:2262-1SUSE-SU-2019:14157-1

  • kernel-syms openSUSE Leap 15.0 4.12.14-lp150.12.70.1
  • kernel-obs-qa openSUSE Leap 15.0 4.12.14-lp150.12.70.1
  • kernel-source openSUSE Leap 15.0 4.12.14-lp150.12.70.1
  • kernel-default openSUSE Leap 15.0 4.12.14-lp150.12.70.1
  • kernel-vanilla openSUSE Leap 15.0 4.12.14-lp150.12.70.1
  • kernel-kvmsmall openSUSE Leap 15.0 4.12.14-lp150.12.70.1
  • kernel-obs-build openSUSE Leap 15.0 4.12.14-lp150.12.70.1
  • kernel-syms openSUSE Leap 15.1 4.12.14-lp151.28.13.1

opensuse advisories openSUSE-SU-2019:1924-1openSUSE-SU-2019:1923-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-1125 updated cvss 5.9

kernel: hw: Spectre SWAPGS gadget vulnerability

  • Red Hat Enterprise Linux 5 kernel
    affected: workaround, no fix available “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821”
  • Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-80.7.2.el8_0, kernel-debuginfo-common-aarch64 4.18.0-80.7.2.el8_0, kernel-debuginfo-common-ppc64le 4.18.0-80.7.2.el8_0 Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-80.7.2.el8_0, kernel 4.18.0-80.7.2.el8_0, bpftool 4.18.0-80.7.2.el8_0, kernel-core 4.18.0-80.7.2.el8_0, kernel-tools 4.18.0-80.7.2.el8_0, python3-perf 4.18.0-80.7.2.el8_0, +15 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2411
  • Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1062.1.1.el7, kernel 3.10.0-1062.1.1.el7, bpftool 3.10.0-1062.1.1.el7, python-perf 3.10.0-1062.1.1.el7, kernel-tools 3.10.0-1062.1.1.el7, kernel-tools-libs 3.10.0-1062.1.1.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.1.1.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-1062.1.1.el7, kernel 3.10.0-1062.1.1.el7, bpftool 3.10.0-1062.1.1.el7, python-perf 3.10.0-1062.1.1.el7, kernel-tools 3.10.0-1062.1.1.el7, kernel-tools-libs 3.10.0-1062.1.1.el7, +2 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2600
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) perf 3.10.0-693.58.1.el7, kernel 3.10.0-693.58.1.el7, python-perf 3.10.0-693.58.1.el7, kernel-tools 3.10.0-693.58.1.el7, kernel-tools-libs 3.10.0-693.58.1.el7, kernel-abi-whitelists 3.10.0-693.58.1.el7, +1 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2696
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) perf 3.10.0-862.43.1.el7, kernel 3.10.0-862.43.1.el7, python-perf 3.10.0-862.43.1.el7, kernel-tools 3.10.0-862.43.1.el7, kernel-tools-libs 3.10.0-862.43.1.el7, kernel-abi-whitelists 3.10.0-862.43.1.el7, +1 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2975
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) perf 3.10.0-957.38.1.el7, kernel 3.10.0-957.38.1.el7, bpftool 3.10.0-957.38.1.el7, python-perf 3.10.0-957.38.1.el7, kernel-tools 3.10.0-957.38.1.el7, kernel-tools-libs 3.10.0-957.38.1.el7, +2 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:3220
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.1.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2600
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.58.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2696
show 26 more
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) kernel-debuginfo-common-x86_64 3.10.0-862.43.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2975
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) kernel-debuginfo-common-x86_64 3.10.0-957.38.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:3220
  • Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-754.18.2.el6, kernel 2.6.32-754.18.2.el6, kernel-firmware 2.6.32-754.18.2.el6, kernel-abi-whitelists 2.6.32-754.18.2.el6, kernel-debuginfo-common-i686 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) python-perf 2.6.32-754.18.2.el6, kernel-debuginfo-common-i686 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2473
  • Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1062.1.1.rt56.1024.el7, kernel-rt-kvm 3.10.0-1062.1.1.rt56.1024.el7, kernel-rt-trace 3.10.0-1062.1.1.rt56.1024.el7, kernel-rt-debug-kvm 3.10.0-1062.1.1.rt56.1024.el7, kernel-rt-trace-kvm 3.10.0-1062.1.1.rt56.1024.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1062.1.1.rt56.1024.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2609
  • Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-754.18.2.el6, kernel 2.6.32-754.18.2.el6, kernel-firmware 2.6.32-754.18.2.el6, kernel-abi-whitelists 2.6.32-754.18.2.el6, kernel-debuginfo-common-i686 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6 Red Hat Enterprise Linux HPC Node Optional (v. 6) python-perf 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2473
  • Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-core 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-modules 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-debug-core 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-debug-modules 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-modules-extra 4.18.0-80.7.2.rt9.154.el8_0, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-kvm 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-core 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-modules 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-debug-kvm 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-debug-core 4.18.0-80.7.2.rt9.154.el8_0, +4 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2405
  • Red Hat Enterprise Linux Realtime (v. 7) kernel-rt 3.10.0-1062.1.1.rt56.1024.el7, kernel-rt-trace 3.10.0-1062.1.1.rt56.1024.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1062.1.1.rt56.1024.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2609
  • Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-754.18.2.el6, kernel 2.6.32-754.18.2.el6, kernel-kdump 2.6.32-754.18.2.el6, kernel-firmware 2.6.32-754.18.2.el6, kernel-bootwrapper 2.6.32-754.18.2.el6, kernel-abi-whitelists 2.6.32-754.18.2.el6, +4 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2473
  • Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1062.1.1.el7, kernel 3.10.0-1062.1.1.el7, bpftool 3.10.0-1062.1.1.el7, python-perf 3.10.0-1062.1.1.el7, kernel-kdump 3.10.0-1062.1.1.el7, kernel-tools 3.10.0-1062.1.1.el7, +7 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2600
  • Red Hat Enterprise Linux Server AUS (v. 6.5) perf 2.6.32-431.96.1.el6, kernel 2.6.32-431.96.1.el6, kernel-firmware 2.6.32-431.96.1.el6, kernel-abi-whitelists 2.6.32-431.96.1.el6, kernel-debuginfo-common-x86_64 2.6.32-431.96.1.el6
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2695
  • Red Hat Enterprise Linux Server AUS (v. 6.6) perf 2.6.32-504.80.2.el6, kernel 2.6.32-504.80.2.el6, kernel-firmware 2.6.32-504.80.2.el6, kernel-abi-whitelists 2.6.32-504.80.2.el6, kernel-debuginfo-common-x86_64 2.6.32-504.80.2.el6
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2476
  • Red Hat Enterprise Linux Server AUS (v. 7.2) perf 3.10.0-327.82.1.el7, kernel 3.10.0-327.82.1.el7, python-perf 3.10.0-327.82.1.el7, kernel-tools 3.10.0-327.82.1.el7, kernel-tools-libs 3.10.0-327.82.1.el7, kernel-abi-whitelists 3.10.0-327.82.1.el7, +1 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2899
  • Red Hat Enterprise Linux Server AUS (v. 7.3) perf 3.10.0-514.69.1.el7, kernel 3.10.0-514.69.1.el7, python-perf 3.10.0-514.69.1.el7, kernel-tools 3.10.0-514.69.1.el7, kernel-tools-libs 3.10.0-514.69.1.el7, kernel-abi-whitelists 3.10.0-514.69.1.el7, +1 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2900
  • Red Hat Enterprise Linux Server E4S (v. 7.2) perf 3.10.0-327.82.1.el7, kernel 3.10.0-327.82.1.el7, python-perf 3.10.0-327.82.1.el7, kernel-tools 3.10.0-327.82.1.el7, kernel-tools-libs 3.10.0-327.82.1.el7, kernel-abi-whitelists 3.10.0-327.82.1.el7, +1 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2899
  • Red Hat Enterprise Linux Server E4S (v. 7.3) perf 3.10.0-514.69.1.el7, kernel 3.10.0-514.69.1.el7, python-perf 3.10.0-514.69.1.el7, kernel-tools 3.10.0-514.69.1.el7, kernel-tools-libs 3.10.0-514.69.1.el7, kernel-bootwrapper 3.10.0-514.69.1.el7, +3 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2900
  • Red Hat Enterprise Linux Server EUS (v. 7.4) perf 3.10.0-693.58.1.el7, kernel 3.10.0-693.58.1.el7, python-perf 3.10.0-693.58.1.el7, kernel-kdump 3.10.0-693.58.1.el7, kernel-tools 3.10.0-693.58.1.el7, kernel-tools-libs 3.10.0-693.58.1.el7, +6 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2696
  • Red Hat Enterprise Linux Server EUS (v. 7.5) perf 3.10.0-862.43.1.el7, kernel 3.10.0-862.43.1.el7, python-perf 3.10.0-862.43.1.el7, kernel-kdump 3.10.0-862.43.1.el7, kernel-tools 3.10.0-862.43.1.el7, kernel-tools-libs 3.10.0-862.43.1.el7, +6 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2975
  • Red Hat Enterprise Linux Server EUS (v. 7.6) perf 3.10.0-957.38.1.el7, kernel 3.10.0-957.38.1.el7, bpftool 3.10.0-957.38.1.el7, python-perf 3.10.0-957.38.1.el7, kernel-kdump 3.10.0-957.38.1.el7, kernel-tools 3.10.0-957.38.1.el7, +7 more
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:3220
  • Red Hat Enterprise Linux Server Optional (v. 6) python-perf 2.6.32-754.18.2.el6, kernel-debuginfo-common-i686 2.6.32-754.18.2.el6, kernel-debuginfo-common-ppc64 2.6.32-754.18.2.el6, kernel-debuginfo-common-s390x 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2473
  • Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1062.1.1.el7, kernel-debuginfo-common-x86_64 3.10.0-1062.1.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-1062.1.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2600
  • Red Hat Enterprise Linux Server Optional AUS (v. 6.5) kernel 2.6.32-431.96.1.el6, python-perf 2.6.32-431.96.1.el6, kernel-debuginfo-common-x86_64 2.6.32-431.96.1.el6
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2695
  • Red Hat Enterprise Linux Server Optional AUS (v. 6.6) python-perf 2.6.32-504.80.2.el6, kernel-debuginfo-common-x86_64 2.6.32-504.80.2.el6
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2476
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.2) kernel-debuginfo-common-x86_64 3.10.0-327.82.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2899
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) kernel-debuginfo-common-x86_64 3.10.0-514.69.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2900
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.2) kernel-debuginfo-common-x86_64 3.10.0-327.82.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2899
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.3) kernel-debuginfo-common-x86_64 3.10.0-514.69.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-514.69.1.el7
    fixed: vendor fix “For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4329821” RHSA-2019:2900

16 more fixed, 1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-075-01 updated cvss 5.5

Siemens SCALANCE, RUGGEDCOM Third-Party

  • Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) <V7.2 Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) <V7.2 Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) <V7.2 Siemens SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) <V7.2 Siemens SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) <V7.2 Siemens SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) <V7.2
    +14 more products
    Siemens SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) <V7.2 Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) <V7.2 Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) <V7.2 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) <V7.2 Siemens SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) <V7.2 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) <V7.2 Siemens SCALANCE M876-4 (6GK5876-4AA10-2BA2) <V7.2 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) <V7.2 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) <V7.2 Siemens SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) <V7.2 Siemens SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) <V7.2 Siemens SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) <V7.2 Siemens SCALANCE S615 (6GK5615-0AA00-2AA2) <V7.2 Siemens SCALANCE S615 EEC (6GK5615-0AA01-2AA2) <V7.2
    affected: fixed in V7.2 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Timeline

  1. Published
  2. First public exploit (EDB-48071)

Exploit prediction

4.52% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-48071 Microsoft Windows Kernel - Information Disclosure local, 2020-01-27

CVSS scores

assigned by version score vector
CNA 3.1 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C
CNA 3.1 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Microsoft Windows 10 Version 1703
  • Microsoft Windows 10 Version 1803
  • Microsoft Windows Server, version 1803 (Server Core Installation)
  • Microsoft Windows 10 Version 1809
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2019 (Server Core installation)
  • Microsoft Windows 10 Version 1709 for 32-bit Systems
  • Microsoft Windows 10 Version 1709
  • Microsoft Windows 10 Version 1903 for 32-bit Systems
  • Microsoft Windows 10 Version 1903 for x64-based Systems
  • Microsoft Windows 10 Version 1903 for ARM64-based Systems
  • Microsoft Windows Server, version 1903 (Server Core installation)
  • Microsoft Windows 10 Version 1507
  • Microsoft Windows 10 Version 1607
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2016 (Server Core installation)
  • Microsoft Windows 7
  • Microsoft Windows 7 Service Pack 1
  • Microsoft Windows 8.1
  • Microsoft Windows Server 2008 Service Pack 2
  • Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)
  • Microsoft Windows Server 2008 Service Pack 2
  • Microsoft Windows Server 2008 R2 Systems Service Pack 1
  • Microsoft Windows Server 2008 R2 Service Pack 1
  • Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)
  • Microsoft Windows Server 2012
  • Microsoft Windows Server 2012 (Server Core installation)
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2012 R2 (Server Core installation)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.