PT-2020-14630 · Siemens · Siveillance Video Client

Published 2020-09-09 · Updated 2023-01-27 · CVE-2020-15785

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siveillance Video Client (All versions)

Description A vulnerability has been identified where the client application transmits usernames to the server in cleartext when Windows NTLM authentication is enabled. This could allow an attacker in a privileged network position to obtain valid administrator login names and use this information to launch further attacks.

Recommendations For all versions, consider disabling Windows NTLM authentication as a temporary workaround to minimize the risk of exploitation. Restrict access to the network to prevent attackers from intercepting cleartext usernames. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-15785

Affected Products

Siveillance Video Client

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-15785 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-252-05 · Note