Unauthorized Access Vulnerability in Siveillance VMS by Siemens
CVE-2019-6580

9.8CRITICAL

Key Information:

Vendor
Siemens
Status
Siveillance Vms 2017 R2
Siveillance Vms 2018 R1
Siveillance Vms 2018 R2
Siveillance Vms 2018 R3
Vendor
CVE Published:
12 June 2019

Summary

A vulnerability exists in Siemens Siveillance VMS, affecting multiple versions across different releases. An attacker with access to port 80/TCP can alter device properties without proper authorization. This security flaw does not require user interaction to exploit, posing significant risks to the confidentiality, integrity, and availability of the system. At the time of the advisory, there were no known instances of public exploitation.

Affected Version(s)

Siveillance VMS 2017 R2 All versions < V11.2a

Siveillance VMS 2018 R1 All versions < V12.1a

Siveillance VMS 2018 R2 All versions < V12.2a

References

https://cert-portal.siemens.com/productcert/pdf/ssa-21200...
x_refsource_MISC
https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.