PT-2018-16567 · Siemens · Siveillance Vms Video For Ios+1

Published 2018-05-03 · Updated 2019-10-09 · CVE-2018-4849

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Siveillance VMS Video for Android versions prior to V12.1a (2018 R1) Siveillance VMS Video for iOS versions prior to V12.1a (2018 R1)

Description A security issue has been identified due to improper certificate validation, which could allow an attacker in a privileged network position to intercept and manipulate the encrypted communication channel between the app and a server. This could be achieved through a Man-in-the-Middle attack, where the attacker generates a certificate with a checksum identical to a trusted certificate. The issue can be exploited without user interaction and affects the confidentiality and integrity of the communication. At the time of reporting, there were no known public exploitations of this issue.

Recommendations For Siveillance VMS Video for Android versions prior to V12.1a (2018 R1), update to version V12.1a (2018 R1) or later to resolve the security issue. For Siveillance VMS Video for iOS versions prior to V12.1a (2018 R1), update to version V12.1a (2018 R1) or later to resolve the security issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2018-4849

Affected Products

Siveillance Vms Video For Android

Siveillance Vms Video For Ios

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-4849 · Security Note
• https://osv.dev/vulnerability/CVE-2018-4849 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-468514.pdf · Vendor Advisory
• http://securityfocus.com/bid/104105 · Note