PT-2023-2732 · Unknown · Siveillance Video

Published 2023-05-09 · Updated 2023-05-17 · CVE-2023-30898

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Siveillance Video 2020 R2 versions prior to V20.2 HotfixRev14 Siveillance Video 2020 R3 versions prior to V20.3 HotfixRev12 Siveillance Video 2021 R1 versions prior to V21.1 HotfixRev12 Siveillance Video 2021 R2 versions prior to V21.2 HotfixRev8 Siveillance Video 2022 R1 versions prior to V22.1 HotfixRev7 Siveillance Video 2022 R2 versions prior to V22.2 HotfixRev5 Siveillance Video 2022 R3 versions prior to V22.3 HotfixRev2 Siveillance Video 2023 R1 versions prior to V23.1 HotfixRev1

Description The issue is related to errors in the data serialization procedure of the Event Server component in the Siveillance VMS platform for video surveillance system management. This could allow a remote attacker to execute arbitrary code on the affected system. The vulnerability is associated with the deserialization of data without sufficient validation, which can be exploited by an authenticated remote attacker.

Recommendations For Siveillance Video 2020 R2 versions prior to V20.2 HotfixRev14, update to V20.2 HotfixRev14 or later. For Siveillance Video 2020 R3 versions prior to V20.3 HotfixRev12, update to V20.3 HotfixRev12 or later. For Siveillance Video 2021 R1 versions prior to V21.1 HotfixRev12, update to V21.1 HotfixRev12 or later. For Siveillance Video 2021 R2 versions prior to V21.2 HotfixRev8, update to V21.2 HotfixRev8 or later. For Siveillance Video 2022 R1 versions prior to V22.1 HotfixRev7, update to V22.1 HotfixRev7 or later. For Siveillance Video 2022 R2 versions prior to V22.2 HotfixRev5, update to V22.2 HotfixRev5 or later. For Siveillance Video 2022 R3 versions prior to V22.3 HotfixRev2, update to V22.3 HotfixRev2 or later. For Siveillance Video 2023 R1 versions prior to V23.1 HotfixRev1, update to V23.1 HotfixRev1 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-02579

CVE-2023-30898

Affected Products

Siveillance Video

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30898 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02579 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-30898 · Security Note