PT-2020-2444 · Unknown · Control Center Server

Published 2020-03-10 · Updated 2024-01-09 · CVE-2019-19292

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Control Center Server versions prior to V1.5.0

Description The issue is related to a lack of protection against SQL query structure exploitation. This can be exploited by a remote attacker to read or modify the central control server database, as well as execute database operations or operating system commands with administrator privileges. The vulnerability is present in the XML-based communication protocol used by the Control Center Server, accessible on ports 5444/tcp and 5440/tcp. An authenticated remote attacker could exploit this to gain administrative access to the database and potentially the operating system.

Recommendations For versions prior to V1.5.0, update to version V1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to ports 5444/tcp and 5440/tcp to minimize the risk of exploitation. Additionally, limiting administrative database operations and operating system commands can help reduce the potential impact of this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2020-02454

CVE-2019-19292

Affected Products

Control Center Server

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02454 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-19292 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf · Note