CVE-2019-10930

Name of the Vulnerable Software and Affected Versions DIGSI 5 versions prior to V7.90 SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87, and 7VE85 versions prior to V7.90 SIPROTEC 5 device types 7SS85 and 7KE85 versions prior to V8.01 SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules (all versions)

Description The issue is related to insufficient input validation in the software. A remote attacker could exploit this by sending specially crafted packets to port 443/TCP, allowing them to upload, download, or delete files in certain parts of the system.

Recommendations For DIGSI 5 versions prior to V7.90, update to version V7.90 or later. For SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87, and 7VE85 versions prior to V7.90, update to version V7.90 or later. For SIPROTEC 5 device types 7SS85 and 7KE85 versions prior to V8.01, update to version V8.01 or later. For SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules, consider disabling access to port 443/TCP as a temporary workaround until a patch is available.