Description
A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration web application (TIA Administrator) allows to execute certain application commands without proper authentication. The vulnerability could be exploited by an attacker with local access to the affected system. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | TIA Administrator | All versions < V1.0 SP1 Upd1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
jiansiting/CVE-2019-10915 ★ 4 · Jul 22, 2019
Siemens TIA administrator Tool RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- ICSA-19-253-02 ICSA-19-253-02 Siemens SINETPLAN CISA ICS & IT advisories · Sep 10, 2019
- ICSA-19-192-03 ICSA-19-192-03 Siemens TIA Administrator (TIA Portal) CISA ICS & IT advisories · Jul 9, 2019