CVE-2019-13941
First published: Tue Feb 11 2020(Updated: )
A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific uniform resource locator on the web server, a remote attacker could be able to download a project file without prior authentication. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected system. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises the confidentiality of the targeted system.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens OZW672 | <10.00 | |
| Siemens OZW672 Firmware | ||
| Siemens OZW772 | <10.00 | |
| OZW OZW772 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-13941?
CVE-2019-13941 has been rated with a high severity level due to its exploitation potential impacting sensitive project files.
How do I fix CVE-2019-13941?
To fix CVE-2019-13941, upgrade your OZW672 or OZW772 firmware to version 10.00 or later.
Who is affected by CVE-2019-13941?
Users of Siemens OZW672 and OZW772 firmware versions earlier than 10.00 are affected by CVE-2019-13941.
What type of vulnerability is CVE-2019-13941?
CVE-2019-13941 is classified as a security vulnerability involving predictable path names used in the OZW Web Server.
Can CVE-2019-13941 be exploited remotely?
Yes, CVE-2019-13941 can be exploited by authenticated users who leverage the application's export function.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens ozw672
- canonical/siemens ozw672 firmware
- canonical/siemens ozw772
- canonical/ozw ozw772