ssa-162506
Vulnerability from csaf_siemens
Published
2020-04-14 00:00
Modified
2025-06-10 00:00
Summary
SSA-162506: DHCP Client Vulnerability in SIMOTICS CONNECT 400, Desigo PXC/PXM, APOGEE MEC/MBC/PXC, APOGEE PXC Series, and TALON TC Series

Notes

Summary
SIMOTICS CONNECT 400, Desigo (Power PC-based), APOGEE MEC/MBC/PXC and TALON TC products are affected by a DHCP Client vulnerability as initially reported in SSA-434032 for the Mentor Nucleus Networking Module. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.


To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SIMOTICS CONNECT 400, Desigo (Power PC-based), APOGEE MEC/MBC/PXC and TALON TC products are affected by a DHCP Client vulnerability as initially reported in \nSSA-434032 for the Mentor Nucleus Networking Module.\nSiemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-162506: DHCP Client Vulnerability in SIMOTICS CONNECT 400, Desigo PXC/PXM, APOGEE MEC/MBC/PXC, APOGEE PXC Series, and TALON TC Series - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-162506.html"
      },
      {
        "category": "self",
        "summary": "SSA-162506: DHCP Client Vulnerability in SIMOTICS CONNECT 400, Desigo PXC/PXM, APOGEE MEC/MBC/PXC, APOGEE PXC Series, and TALON TC Series - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-162506.json"
      }
    ],
    "title": "SSA-162506: DHCP Client Vulnerability in SIMOTICS CONNECT 400, Desigo PXC/PXM, APOGEE MEC/MBC/PXC, APOGEE PXC Series, and TALON TC Series",
    "tracking": {
      "current_release_date": "2025-06-10T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-162506",
      "initial_release_date": "2020-04-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2020-04-14T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2021-01-12T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added solution for Desigo PXC and PXM20"
        },
        {
          "date": "2022-04-12T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Listed all affected Desigo PXC and PXM20 products explicitly. Added solution for APOGEE PXC Series (BACnet) and TALON TC Series (BACnet)"
        },
        {
          "date": "2022-05-10T00:00:00Z",
          "legacy_version": "1.3",
          "number": "4",
          "summary": "Added solution for APOGEE PXC Series (P2)"
        },
        {
          "date": "2025-06-10T00:00:00Z",
          "legacy_version": "1.4",
          "number": "5",
          "summary": "CVE-2019-13939: Added CVSSv4.0 vector and changed CWE from CWE-840 to CWE-20"
        }
      ],
      "status": "interim",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV2.8.2",
                "product": {
                  "name": "APOGEE MEC/MBC/PXC (P2)",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE MEC/MBC/PXC (P2)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.5.3",
                "product": {
                  "name": "APOGEE PXC Compact (BACnet)",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Compact (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.8.2|\u003cV2.8.19",
                "product": {
                  "name": "APOGEE PXC Compact (P2 Ethernet)",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Compact (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.5.3",
                "product": {
                  "name": "APOGEE PXC Modular (BACnet)",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Modular (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.8.2|\u003cV2.8.19",
                "product": {
                  "name": "APOGEE PXC Modular (P2 Ethernet)",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Modular (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC00-E.D",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC00-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions \u003e= V2.3x and \u003c V6.00.327",
                "product": {
                  "name": "Desigo PXC00-U",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC00-U"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC001-E.D",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC001-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC12-E.D",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC12-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC22-E.D",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC22-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC22.1-E.D",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC22.1-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC36.1-E.D",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC36.1-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC50-E.D",
                  "product_id": "13"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC50-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions \u003e= V2.3x and \u003c V6.00.327",
                "product": {
                  "name": "Desigo PXC64-U",
                  "product_id": "14"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC64-U"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC100-E.D",
                  "product_id": "15"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC100-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions \u003e= V2.3x and \u003c V6.00.327",
                "product": {
                  "name": "Desigo PXC128-U",
                  "product_id": "16"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC128-U"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXC200-E.D",
                  "product_id": "17"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC200-E.D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003e=V2.3|\u003cV6.0.327",
                "product": {
                  "name": "Desigo PXM20-E",
                  "product_id": "18"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXM20-E"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV0.3.0.330",
                "product": {
                  "name": "SIMOTICS CONNECT 400",
                  "product_id": "19"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOTICS CONNECT 400"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.5.3",
                "product": {
                  "name": "TALON TC Compact (BACnet)",
                  "product_id": "20"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Compact (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.5.3",
                "product": {
                  "name": "TALON TC Modular (BACnet)",
                  "product_id": "21"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Modular (BACnet)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-13939",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE, Desigo, and TALON products.)",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21"
          ]
        },
        {
          "category": "mitigation",
          "details": "APOGEE MEC, MBC, PXC (versions prior to V2.8.2): Use static IP address configuration as described above",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21"
          ]
        },
        {
          "category": "mitigation",
          "details": "APOGEE PXC Series and TALON TC Series products: If using static IP address is not possible, update to the fix version listed above or contact your local Siemens office for support",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.19 or later version",
          "product_ids": [
            "3",
            "5"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.3 or later version",
          "product_ids": [
            "2",
            "4",
            "20",
            "21"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V6.0.327 or later version",
          "product_ids": [
            "6",
            "9",
            "10",
            "11",
            "12",
            "13",
            "15",
            "17",
            "18"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109791941/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V6.00.327 or later version",
          "product_ids": [
            "7",
            "14",
            "16"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109791941/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V6.00.327 or later version",
          "product_ids": [
            "8"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V0.3.0.330 or later version",
          "product_ids": [
            "19"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21"
          ]
        }
      ],
      "title": "CVE-2019-13939"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.