Deserialization Flaw in Siveillance Video from Siemens
CVE-2023-30898

9.9CRITICAL

Key Information:

Vendor
Siemens
Status
Siveillance Video 2020 R2
Siveillance Video 2020 R3
Siveillance Video 2021 R1
Siveillance Video 2021 R2
Vendor
CVE Published:
9 May 2023

Summary

A vulnerability in Siemens Siveillance Video systems allows an authenticated remote attacker to exploit the Event Server component, which inadequately validates deserialized data. This flaw could lead to unauthorized code execution on the affected systems, highlighting a significant security concern for users operating versions below specific hotfixes across various releases.

Affected Version(s)

Siveillance Video 2020 R2 All versions < V20.2 HotfixRev14

Siveillance Video 2020 R3 All versions < V20.3 HotfixRev12

Siveillance Video 2021 R1 All versions < V21.1 HotfixRev12

References

https://cert-portal.siemens.com/productcert/pdf/ssa-78934...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.