CVE-2019-10938

Estado: ModificadaCrítica (9.8)—
A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions < V8.01), Siemens Power Meters Series 9410 (All versions < V2.2.1), Siemens Power Meters Series 9810 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.49%
Percentil entre todas las CVEs puntuadas: 73
Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Siemens — Siprotec 5 Digsi Device Driver
CWE

CWE-284
NVD-CWE-Other
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-10938",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens AG",
          "product": "SIPROTEC 5 devices with CPU variants CP200",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V7.59"
            }
          ]
        },
        {
          "vendor": "Siemens AG",
          "product": "SIPROTEC 5 devices with CPU variants CP300 and CP100",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V8.01"
            }
          ]
        },
        {
          "vendor": "Siemens AG",
          "product": "Siemens Power Meters Series 9410",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V2.2.1"
            }
          ]
        },
        {
          "vendor": "Siemens AG",
          "product": "Siemens Power Meters Series 9810",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-02T14:15:14.147",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions < V8.01), Siemens Power Meters Series 9410 (All versions < V2.2.1), Siemens Power Meters Series 9810 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device. At the time of advisory publication no public exploitation of this security vulnerability was known."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en los dispositivos SIPROTEC 5 con variantes de CP200 (Todas las versiones anteriores a la versión V7.59), dispositivos SIPROTEC 5 con variantes de CP300 y CP100 (Todas las versiones anteriores a la versión V8.01), Siemens Power Meters Series 9410 (Todas las versiones anteriores a la versión V2.2.1), Siemens Power Meters Series 9810 (Todas las versiones). Un atacante no autenticado con acceso de red al dispositivo podría insertar un código arbitrario que se ejecuta antes de la verificación del firmware en el dispositivo. En el momento de la publicación del aviso, no se conocía la explotación pública de esta vulnerabilidad de seguridad"
    }
  ],
  "lastModified": "2026-06-17T02:11:57.287",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:siprotec_5_digsi_device_driver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "302821EE-C152-47A9-95F6-9D6B82803E3C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:6md85:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "23076116-128D-4366-B5BC-B965001FE356"
            },
            {
              "criteria": "cpe:2.3:h:siemens:6md86:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3457758B-A04D-4544-B0FA-DF87AA11D8FE"
            },
            {
              "criteria": "cpe:2.3:h:siemens:6md89:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1F0672FC-AEC1-445B-B958-AEDB6DCEE1E6"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sa82:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AF247CA0-37E1-40DF-96F5-9F00128EA250"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sa86:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EDD3C99B-CDD8-4919-BE72-73814C2642A4"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sa87:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DBE6CCA9-A246-4EB2-A57B-FE6823A9E3FD"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sd82:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E11B4A68-F533-4AC0-80A9-7374FDFE2DEA"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sd86:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "73F8D692-F268-45A4-9348-C67890A58881"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sd87:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3C5A3FFD-17AD-4820-97D3-2F093BD5F322"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sj82:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5739872A-E271-48BB-ABB5-17608E81AE7A"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sj85:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "ECC6417D-2C81-4654-B7FF-6C3E1B709962"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sj86:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C52A6630-46F3-4113-B5E8-F5BAB7801CB0"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sk82:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "088AC7F2-4FF3-4EF9-A111-D47DB859ECA1"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sk85:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "73DD95AC-9B8F-43CD-9483-2BB9C4E86376"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sl82:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8A9F05D9-C1DF-4D73-8634-239ABFE526DB"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sl86:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0C6662F7-5E3D-43A8-9984-EF1540BC917B"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7sl87:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E122323B-A42B-4DAB-A071-ACF76DC45E28"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7um85:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AAA9E810-2C00-4721-B3A6-E7CD7184BA24"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7ut82:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2E959A8E-21D1-4950-974B-A89693C14DC9"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7ut85:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DA075D19-21BF-4A7C-87B8-6A9D99799826"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7ut86:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7AC0D445-9A9B-4799-8B83-8B15821A6CC1"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7ut87:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D2A73860-76C5-435B-8150-1EABF644ADA0"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7ve85:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2D58566D-C2F7-4D9A-ACD6-D493E4531491"
            },
            {
              "criteria": "cpe:2.3:h:siemens:7vk87:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5D9FD3B7-C7F7-41C1-9290-411F9D912D00"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}