CVE-2019-13946
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedProfinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe Profinet-IO stack versions before V06.00 fail to properly limit internal resource allocation when processing multiple legitimate diagnostic package requests sent to the DCE-RPC interface. This allows an attacker to exhaust device memory by sending multiple requests, causing a denial of service condition.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE dataall versions< 2.1all versions< 4.5< 4.6< 4.3< 4.3< 4.3CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the Siemens device or product modelLocate the device label, management console, or network inventory to determine the exact product name (e.g., Ek Ertec 200, Ruggedcom RM1224, Scalance M800, etc.)Affected if The device is one of the affected products listed in the CVE (Dk Standard Ethernet Controller, Profinet Driver, Simatic Ipc Support, Ek Ertec 200, Ek Ertec 200p, Ruggedcom RM1224, Scalance M800, Scalance S615)
-
Determine the firmware or driver versionAccess the device web interface, CLI, or management software and locate the firmware version or driver version information. For Profinet Driver, check the installed driver version through the system device manager or Siemens management tool.Affected if The version is below the safe threshold: Profinet Driver < 2.1, Ek Ertec 200 Firmware < 4.5, Ek Ertec 200p Firmware < 4.6, Ruggedcom RM1224 Firmware < 4.3, Scalance M800 Firmware < 4.3, Scalance S615 Firmware < 4.3, or for Dk Standard Ethernet Controller/Simatic Ipc Support which have no fix (all ve
-
Verify DCE-RPC interface exposureCheck network configuration, firewall rules, or device management settings to determine if the DCE-RPC interface (typically port 135 or 49152-49156 for RPC) is enabled and accessible from the networkAffected if The DCE-RPC interface is enabled and reachable from an untrusted network, which allows an attacker to send the multiple diagnostic package requests that trigger the memory exhaustion
-
Check for memory exhaustion indicatorsMonitor device memory usage, CPU load, or network throughput logs. Look for signs of memory consumption spikes or device unresponsiveness following multiple DCE-RPC diagnostic requests.Affected if Device memory steadily increases or the device becomes unresponsive after processing multiple DCE-RPC diagnostic requests, indicating the resource exhaustion vulnerability is being triggered
The environment is affected if the deployed Siemens device uses Profinet-IO stack firmware or a driver version below the safe thresholds AND has the DCE-RPC interface exposed, allowing an attacker to send multiple diagnostic requests that exhaust memory.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor data2.14.34.5
Upgrade the PNIO stack to version V06.00 or later to obtain the patched firmware. Alternatively, implement network-level access controls or rate limiting on the DCE-RPC interface to restrict diagnostic request volume.
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2019-13946 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2019-13946 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data