SQL Injection Vulnerability in Control Center Server by Siemens

CVE-2019-19292

What is CVE-2019-19292?

The Control Center Server (CCS) by Siemens is susceptible to an SQL injection vulnerability present in its XML-based communication protocol. This issue arises when the service is configured to operate on default ports 5444/tcp and 5440/tcp. An authenticated remote attacker can leverage this vulnerability to gain access to the CCS database, allowing them to read or modify data and potentially execute unauthorized administrative database operations or even system commands.

References