PT-2018-16567 · Siemens · Siveillance Vms Video For Ios+1

Publicado 2018-05-03 · Atualizado 2019-10-09 · CVE-2018-4849

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Siveillance VMS Video for Android versions prior to V12.1a (2018 R1) Siveillance VMS Video for iOS versions prior to V12.1a (2018 R1)

Description A security issue has been identified due to improper certificate validation, which could allow an attacker in a privileged network position to intercept and manipulate the encrypted communication channel between the app and a server. This could be achieved through a Man-in-the-Middle attack, where the attacker generates a certificate with a checksum identical to a trusted certificate. The issue can be exploited without user interaction and affects the confidentiality and integrity of the communication. At the time of reporting, there were no known public exploitations of this issue.

Recommendations For Siveillance VMS Video for Android versions prior to V12.1a (2018 R1), update to version V12.1a (2018 R1) or later to resolve the security issue. For Siveillance VMS Video for iOS versions prior to V12.1a (2018 R1), update to version V12.1a (2018 R1) or later to resolve the security issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2018-4849

Produtos afetados

Siveillance Vms Video For Android

Siveillance Vms Video For Ios

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-4849 · Nota de Segurança
• http://securityfocus.com/bid/104105 · Nota
• https://osv.dev/vulnerability/CVE-2018-4849 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/pdf/ssa-468514.pdf · Aviso do Fabricante