CVE-2019-13939

Q: What is the severity of CVE-2019-13939?

CVE-2019-13939 has a CVSS score of 7.1 (HIGH). This vulnerability allows attackers to send specially crafted DHCP packets to change a device's IP address to an invalid value when the DHCP client is enabled. It affects multiple Siemens building automation and industrial control system products. The attack requires network access to the vulnerable device.

7.1 HIGH

📋 TL;DR

This vulnerability allows attackers to send specially crafted DHCP packets to change a device's IP address to an invalid value when the DHCP client is enabled. It affects multiple Siemens building automation and industrial control system products. The attack requires network access to the vulnerable device.

💻 Affected Systems

Products:

APOGEE MEC/MBC/PXC (P2)
APOGEE PXC Compact (BACnet)
APOGEE PXC Compact (P2 Ethernet)
APOGEE PXC Modular (BACnet)
APOGEE PXC Modular (P2 Ethernet)
Capital Embedded AR Classic 431-422
Capital Embedded AR Classic R20-11
Desigo PXC00-E.D
Desigo PXC00-U
Desigo PXC001-E.D
Desigo PXC100-E.D
Desigo PXC12-E.D
Desigo PXC128-U
Desigo PXC200-E.D
Desigo PXC22-E.D
Desigo PXC22.1-E.D
Desigo PXC36.1-E.D
Desigo PXC50-E.D
Desigo PXC64-U
Desigo PXM20-E
Nucleus NET
Nucleus ReadyStart V3
Nucleus Source Code
SIMOTICS CONNECT 400
TALON TC Compact (BACnet)
TALON TC Modular (BACnet)

Versions: Varies by product - see CVE description for specific version ranges

Operating Systems: Embedded systems running affected Siemens products

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability only exists when DHCP client is enabled on affected devices. Devices using static IP configuration are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Network disruption causing loss of connectivity to critical building automation or industrial control systems, potentially affecting HVAC, lighting, or other facility operations.

🟠

Likely Case

Temporary loss of network connectivity to affected devices requiring manual intervention to restore proper IP configuration.

🟢

If Mitigated

Minimal impact if devices are on isolated networks with proper DHCP server controls and network segmentation.

🌐 Internet-Facing: MEDIUM - Devices directly exposed to internet could be targeted, but attack requires DHCP client enabled and specific network conditions.

🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could exploit this to disrupt operations of affected devices.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted DHCP packets to the vulnerable device's network interface. No authentication required if network access is obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Varies by product - APOGEE P2: V2.8.19+, APOGEE BACnet: V3.5.3+, Desigo: V6.0.327+, Nucleus ReadyStart: V2017.02.3+, SIMOTICS: V0.3.0.330+

Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-162506.html

Restart Required: Yes

Instructions:

1. Identify affected products and versions. 2. Download appropriate firmware updates from Siemens support portal. 3. Follow vendor-specific update procedures for each device type. 4. Verify successful update and proper device functionality.

🔧 Temporary Workarounds

Disable DHCP Client

all

Configure affected devices with static IP addresses instead of using DHCP

Network Segmentation

all

Isolate affected devices on separate VLANs with strict firewall rules limiting DHCP traffic

🧯 If You Can't Patch

Implement strict network segmentation to isolate affected devices
Deploy network monitoring to detect anomalous DHCP traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check device firmware version against affected version ranges in Siemens advisories. Verify if DHCP client is enabled.

Check Version:

Varies by product - typically accessed through device web interface or management software

Verify Fix Applied:

Confirm firmware version is updated to patched version. Test DHCP functionality to ensure proper IP assignment.

📡 Detection & Monitoring

Log Indicators:

Unexpected IP address changes
DHCP error messages
Network connectivity loss logs

Network Indicators:

Unusual DHCP packet patterns
Multiple DHCP requests from single device
DHCP packets with malformed options

SIEM Query:

source="dhcp" AND (message="malformed" OR message="invalid" OR dest_ip="0.0.0.0" OR dest_ip="255.255.255.255")

📊 Metadata

CVE ID: CVE-2019-13939

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE: CWE-20

Published: January 16, 2020

Last Updated: June 10, 2025

🔗 References

https://cert-portal.siemens.com/productcert/html/ssa-162506.html
https://cert-portal.siemens.com/productcert/html/ssa-434032.html
https://cert-portal.siemens.com/productcert/pdf/ssa-162506.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-105-06 Third Party Advisory,US Government Resource
https://cert-portal.siemens.com/productcert/html/ssa-162506.html
https://cert-portal.siemens.com/productcert/html/ssa-434032.html
https://cert-portal.siemens.com/productcert/pdf/ssa-162506.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-105-06 Third Party Advisory,US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Apogee Modular Building Controller Firmware by Siemens

Apogee Modular Equiment Controller Firmware by Siemens

Apogee Pxc Firmware by Siemens

Capital Vstar by Siemens

Desigo Pxc Firmware by Siemens

Desigo Pxc00 E.d Firmware by Siemens

Desigo Pxc00 U Firmware by Siemens

Desigo Pxc001 E.d Firmware by Siemens

Desigo Pxc12 E.d Firmware by Siemens

Desigo Pxc22 E.d Firmware by Siemens

Desigo Pxc22.1 E.d Firmware by Siemens

Desigo Pxc36.1 E.d Firmware by Siemens

Desigo Pxm20 Firmware by Siemens

Desigopxc100 E.d Firmware by Siemens

Desigopxc128 U Firmware by Siemens

Desigopxc200 E.d Firmware by Siemens

Desigopxc50 E.d Firmware by Siemens

Desigopxc64 U Firmware by Siemens

Desigopxm20 E Firmware by Siemens

Nucleus Net by Siemens

Nucleus Readystart by Siemens

Nucleus Rtos by Siemens

Nucleus Safetycert by Siemens

Nucleus Source Code by Siemens

Simotics Connect 400 Firmware by Siemens

Talon Tc Firmware by Siemens