PT-2021-7804 · Unknown · Siveillance Video Open Network Bridge

Published 2021-04-13 · Updated 2022-04-25 · CVE-2021-27392

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Siveillance Video Open Network Bridge versions 2018 R2 through 2020 R3

Description A vulnerability has been identified in Siveillance Video Open Network Bridge, where affected Open Network Bridges store user credentials for authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK, allowing an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server. This issue is related to the use of a hard-coded cryptographic key in the software.

Recommendations For Siveillance Video Open Network Bridge versions 2018 R2 through 2020 R3, consider disabling the storage of user credentials for ONVIF authentication until a patch is available. Restrict access to the MIP SDK to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

BDU:2023-02956

CVE-2021-27392

Affected Products

Siveillance Video Open Network Bridge

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02956 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27392 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27392 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-21-103-15 · Note