Unauthorized Role Change Vulnerability in Siveillance VMS from Siemens

CVE-2019-6581

Summary

A vulnerability exists within the Siveillance VMS software that allows an authenticated attacker with network access to port 80/TCP to change user roles without appropriate authorization. This security flaw can be exploited remotely, compromising the system's confidentiality, integrity, and availability. There is no requirement for user interaction to carry out this exploit, highlighting a significant risk in network security for the affected versions of Siveillance VMS. At the time of this advisory, there have been no reported public exploits targeting this vulnerability.

References