{"schemaVersion":3,"id":"CVE-2019-18293","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18289, CVE-2019-18295, and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.","dates":{"published":"2019-12-12T19:08:47.000Z","modified":"2024-08-05T01:47:14.161Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04926,"percentile":0.92047,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.04926},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.04926,"percentile":0.92047}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04926,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.04926,"percentile":0.92047}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-122","name":"Heap-based Buffer Overflow","description":"A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/122.html"},{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"siemens","product":"sppa-t3000_ms3000_migration_server","name":"sppa-t3000 ms3000 migration server","label":"sppa-t3000_ms3000_migration_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":"/vendor/siemens/sppa-t3000_ms3000_migration_server"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf","label":"cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf","hostname":"cert-portal.siemens.com","tags":["X Refsource MISC","Mitigation","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html","label":"packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-12-12T19:08:47.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T01:47:14.161Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T05:16:07.373Z","stale":false,"partial":false}}