https://cert-portal.siemens.com/productcert/pdf/ssa-121293.pdf

The SIMATIC WinCC DataMonitor web application of the affected products allows an authenticated user with network access to the WinCC DataMonitor application to upload arbitrary ASPX code. Successful exploitation requires no user interaction and may impact the confidentiality, integrity, and availability of the affected device. The vulnerability is relevant only in situations where an attacker has access via the web interface but not to the directory structure.

The version of Siemens SIMATIC WinCC (TIA Portal) installed on the remote Windows host is prior or equal to version 15.1 update 2. It is, therefore, affected by a code upload vulnerability. An authenticated attacker with network access to the WinCC DataMonitor application could exploit this vulnerability to upload and execute arbitrary ASPX code.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
720309	Siemens SIMATIC PCS7 < V9.1 and TIA Portal < 15.2 Unrestricted Upload of File with Dangerous Type (ICSA-19-192-02)	Nessus Network Monitor	SCADA	high
127057	Siemens SIMATIC WinCC (TIA Portal) Code Upload Vulnerability (SSA-121293)	Nessus	SCADA	high

CVE-2019-10935

high

Tenable Plugins

high

high