{"id":"CVE-2019-10938","aliases":["EUVD-2019-2652","GHSA-5vvv-cppj-rx9m"],"status":"published","title":"A vulnerability has been identified in Ethernet plug-in communication modules for SIPROTEC 5...","description":"A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions \u003c V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions \u003c V8.01), Siemens Power Meters Series 9410 (All versions \u003c V2.2.1), Siemens Power Meters Series 9810 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device. At the time of advisory publication no public exploitation of this security vulnerability was known.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01495,"percentile":0.74356,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2019-08-02T13:54:07Z","modified":"2026-06-17T02:11:57Z","products":[{"vendor":"siemens","product":"siprotec_5_digsi_device_driver"},{"vendor":"siemens ag","product":"siemens power meters series 9410"},{"vendor":"siemens ag","product":"siemens power meters series 9810"},{"vendor":"siemens ag","product":"siprotec 5 devices with cpu variants cp200"},{"vendor":"siemens ag","product":"siprotec 5 devices with cpu variants cp300 and cp100"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf","tags":["x_refsource_MISC","x_transferred","Mitigation","Patch","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10938"},{"url":"https://github.com/advisories/GHSA-5vvv-cppj-rx9m"}],"sources":{"cve":[{"id":"CVE-2019-10938","description":"A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions \u003c V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions \u003c V8.01), Siemens Power Meters Series 9410 (All versions \u003c V2.2.1), Siemens Power Meters Series 9810 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device. At the time of advisory publication no public exploitation of this security vulnerability was known.","status":"published","published":"2019-08-02T13:54:07Z","modified":"2024-08-04T22:40:15.404Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2019-2652","description":"A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions \u003c V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions \u003c V8.01), Siemens Power Meters Series 9410 (All versions \u003c V2.2.1), Siemens Power Meters Series 9810 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device. At the time of advisory publication no public exploitation of this security vulnerability was known.","status":"published","published":"2019-08-02T13:54:07Z","modified":"2024-08-04T22:40:15Z","updated_at":"2026-11-03T02:40:50.763878Z"}],"ghsa":[{"id":"GHSA-5vvv-cppj-rx9m","title":"A vulnerability has been identified in Ethernet plug-in communication modules for SIPROTEC 5...","description":"A vulnerability has been identified in Ethernet plug-in communication modules for SIPROTEC 5 devices with CPU variants CP200 (All versions), SIPROTEC 5 devices with CPU variants CP300 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device.","status":"published","published":"2022-05-24T16:52:20Z","modified":"2023-01-28T05:06:23Z","updated_at":"2026-11-02T14:44:25.86191Z"}],"nvd":[{"id":"CVE-2019-10938","description":"A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions \u003c V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions \u003c V8.01), Siemens Power Meters Series 9410 (All versions \u003c V2.2.1), Siemens Power Meters Series 9810 (All versions). An unauthenticated attacker with network access to the device could potentially insert arbitrary code which is executed before firmware verification in the device. At the time of advisory publication no public exploitation of this security vulnerability was known.","status":"published","published":"2019-08-02T14:15:14.147Z","modified":"2026-06-17T02:11:57.287Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:05:21.892729Z"}]}}