Unauthorized Role Change Vulnerability in Siveillance VMS from Siemens
CVE-2019-6581

8.8HIGH

Key Information:

Vendor

Siemens
Status
Siveillance Vms 2017 R2
Siveillance Vms 2018 R1
Siveillance Vms 2018 R2
Siveillance Vms 2018 R3
Vendor
CVE Published:
12 June 2019

What is CVE-2019-6581?

A vulnerability exists within the Siveillance VMS software that allows an authenticated attacker with network access to port 80/TCP to change user roles without appropriate authorization. This security flaw can be exploited remotely, compromising the system's confidentiality, integrity, and availability. There is no requirement for user interaction to carry out this exploit, highlighting a significant risk in network security for the affected versions of Siveillance VMS. At the time of this advisory, there have been no reported public exploits targeting this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Siveillance VMS 2017 R2 All versions < V11.2a

Siveillance VMS 2018 R1 All versions < V12.1a

Siveillance VMS 2018 R2 All versions < V12.2a

References

https://cert-portal.siemens.com/productcert/pdf/ssa-21200...
x_refsource_MISC
https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.