Authentication Bypass Vulnerability in Control Center Server by Siemens

CVE-2019-18337

Summary

A vulnerability exists in the Control Center Server (CCS) that allows remote attackers to bypass authentication through its XML-based communication protocol. This issue arises due to improper handling of authentication requests on ports 5444/tcp and 5440/tcp. An attacker with network access to the CCS server could exploit this vulnerability to gain unauthorized access to the CCS user database, potentially exposing user passwords in obfuscated cleartext. It is essential for users of affected CCS versions to apply patches and updates to mitigate the risks associated with this vulnerability.

References