CVE-2019-8259: siemens sinumerik_access_mymachine\/p2p Improper Initialization
Vulnerability summary
CVE-2019-8259 is a high (CVSS 7.5) Improper Initialization vulnerability in siemens sinumerik_access_mymachine\/p2p. EPSS estimates a 3.01% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities.
Timeline
- 05-03-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1199.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.01%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.01% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Affected systems
3 vendors · 5 products
References
6 links- ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-005-ultravnc-memory-leak/X Refsource MISCThird Party Advisory
- www.us-cert.gov/ics/advisories/icsa-20-161-06X Refsource MISCThird Party AdvisoryUS Government Resource
- cert-portal.siemens.com/productcert/pdf/ssa-940818.pdfX Refsource CONFIRM
- cert-portal.siemens.com/productcert/pdf/ssa-286838.pdfX Refsource CONFIRM
us-cert.cisa.gov/ics/advisories/icsa-21-131-11X Refsource MISC