PT-2019-2666 · Siemens · Siveillance Vms

Published 2019-06-11 · Updated 2020-10-16 · CVE-2019-6580

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siveillance VMS versions prior to V11.2a Siveillance VMS versions prior to V12.1a Siveillance VMS versions prior to V12.2a Siveillance VMS versions prior to V12.3a Siveillance VMS versions prior to V13.1a

Description The issue is related to inadequate access control in the Siveillance VMS platform, which can be exploited by a remote attacker to modify device settings using a web service. An attacker with network access to port 80/TCP can change device properties without authorization, compromising the confidentiality, integrity, and availability of the targeted system. No user interaction is required for exploitation.

Recommendations For versions prior to V11.2a, update to version V11.2a or later. For versions prior to V12.1a, update to version V12.1a or later. For versions prior to V12.2a, update to version V12.2a or later. For versions prior to V12.3a, update to version V12.3a or later. For versions prior to V13.1a, update to version V13.1a or later.

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

BDU:2019-02553

CVE-2019-6580

Affected Products

Siveillance Vms

References · 5

• https://bdu.fstec.ru/vul/2019-02553 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6580 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6580 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01 · Note