PT-2019-15356 · Unknown · Control Center Server

Published 2019-12-12 · Updated 2024-01-09 · CVE-2019-18337

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Control Center Server (CCS) versions prior to V1.5.0

Description A remote attacker with network access to the CCS server could exploit an authentication bypass vulnerability in the XML-based communication protocol, as provided by default on ports 5444/tcp and 5440/tcp, to read the CCS users database, including the passwords of all users in obfuscated cleartext.

Recommendations For versions prior to V1.5.0, update to version V1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to ports 5444/tcp and 5440/tcp to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-18337

Affected Products

Control Center Server

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18337 · Security Note
• https://t.me/cvenotify/13148 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf · Note