Remote Code Execution Vulnerability in Siveillance Video by Siemens
CVE-2023-30899

9.9CRITICAL

Key Information:

Vendor
Siemens
Status
Siveillance Video 2020 R2
Siveillance Video 2020 R3
Siveillance Video 2021 R1
Siveillance Video 2021 R2
Vendor
CVE Published:
9 May 2023

Summary

A vulnerability has been identified within the Management Server component of Siveillance Video, where insufficient validation while deserializing data may exist. This security flaw potentially permits authenticated remote attackers to execute arbitrary code on the affected systems. Several versions across different releases of Siveillance Video are susceptible, underscoring the need for prompt updates to the latest hotfix releases to mitigate this risk.

Affected Version(s)

Siveillance Video 2020 R2 All versions < V20.2 HotfixRev14

Siveillance Video 2020 R3 All versions < V20.3 HotfixRev12

Siveillance Video 2021 R1 All versions < V21.1 HotfixRev12

References

https://cert-portal.siemens.com/productcert/pdf/ssa-78934...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.