{"cve":"CVE-2019-13946","nvd":{"published":"2020-02-11T16:15:15.023","modified":"2026-06-17T02:17:28.250","status":"Modified","description":"Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit\ninternal resource allocation when multiple legitimate diagnostic package\nrequests are sent to the DCE-RPC interface.\nThis could lead to a denial of service condition due to lack of memory\nfor devices that include a vulnerable version of the stack.\n\nThe security vulnerability could be exploited by an attacker with network\naccess to an affected device. Successful exploitation requires no system\nprivileges and no user interaction. An attacker could use the vulnerability\nto compromise the availability of the device.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://cert-portal.siemens.com/productcert/html/ssa-780073.html","https://cert-portal.siemens.com/productcert/pdf/ssa-780073.pdf","https://cert-portal.siemens.com/productcert/html/ssa-780073.html","https://cert-portal.siemens.com/productcert/pdf/ssa-780073.pdf"],"products":["siemens:dk_standard_ethernet_controller","siemens:ek-ertec_200_firmware","siemens:ek-ertec_200p_firmware","siemens:im_154-3_pn_hf_firmware","siemens:im_154-4_pn_hf_firmware","siemens:profinet_driver","siemens:ruggedcom_rm1224_firmware","siemens:scalance_m-800_firmware","siemens:scalance_s615_firmware","siemens:scalance_w700_ieee_802.11n_firmware","siemens:scalance_x-200irt_firmware","siemens:scalance_x-300_firmware","siemens:scalance_x-400_firmware","siemens:scalance_xb-200_firmware","siemens:scalance_xc-200_firmware","siemens:scalance_xf-200_firmware","siemens:scalance_xf-200ba_firmware","siemens:scalance_xm-400_firmware","siemens:scalance_xp-200_firmware","siemens:scalance_xr-300wg_firmware","siemens:scalance_xr524_firmware","siemens:scalance_xr526_firmware","siemens:scalance_xr528_firmware","siemens:scalance_xr552_firmware","siemens:simatic_cp_1604_firmware","siemens:simatic_cp_1616_firmware","siemens:simatic_cp_343-1_advanced_firmware","siemens:simatic_cp_343-1_erpc_firmware","siemens:simatic_cp_343-1_firmware","siemens:simatic_cp_343-1_lean_firmware","siemens:simatic_cp_443-1_advanced_firmware","siemens:simatic_cp_443-1_firmware","siemens:simatic_cp_443-1_opc_ua_firmware","siemens:simatic_et200al_im_157-1_pn_firmware","siemens:simatic_et200ecopn_firmware","siemens:simatic_et200m_im153-4_pn_io_hf_firmware","siemens:simatic_et200m_im153-4_pn_io_st_firmware","siemens:simatic_et200mp_im155-5_pn_hf_firmware","siemens:simatic_et200mp_im155-5_pn_st_firmware","siemens:simatic_et200pro_firmware","siemens:simatic_et200s_firmware","siemens:simatic_et200sp_im155-6_pn_basic_firmware","siemens:simatic_et200sp_im155-6_pn_hf_firmware","siemens:simatic_et200sp_im155-6_pn_st_firmware","siemens:simatic_ipc_support","siemens:simatic_mv420_firmware","siemens:simatic_mv440_firmware","siemens:simatic_pn\\/pn_coupler_firmware","siemens:simatic_rf180c_firmware","siemens:simatic_rf182c_firmware"],"source":"nvd","synced_at":"2026-10-19T21:02:53.949909883+00:00"},"epss":{"cve":"CVE-2019-13946","score":0.0146,"percentile":0.73575,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}