Auth bypass in Siemens Siveillance Video Management Software 2017 R2
CVE-2019-6580
A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R2 (All versions < V12.2a), Siveillance VMS 2018 R3 (All versions < V12.3a), Siveillance VMS 2019 R1 (All versions < V13.1a). An attacker with network access to port 80/TCP could change device properties without authorization. No user interaction is required to exploit this security vulnerability. Successful exploitation compromises confidentiality, integrity and availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.017 (75.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 75.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
- Siemens Siveillance Video Management Software 2017 R2
- Siemens Siveillance Video Management Software 2018 R1
- Siemens Siveillance Video Management Software 2018 R2
- Siemens Siveillance Video Management Software 2018 R3
- Siemens Siveillance Video Management Software 2019 R1
- Siemens Ag Siveillance Vms 2017 R2 — versions All versions < V11.2a
- Siemens Ag Siveillance Vms 2018 R1 — versions All versions < V12.1a
- Siemens Ag Siveillance Vms 2018 R2 — versions All versions < V12.2a
- Siemens Ag Siveillance Vms 2018 R3 — versions All versions < V12.3a
- Siemens Ag Siveillance Vms 2019 R1 — versions All versions < V13.1a
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf (Patch, Vendor Advisory)
- ics-cert.us-cert.gov/advisories/ICSA-19-162-01 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-6580?
- CVE-2019-6580 is a critical-severity vulnerability in Siemens Siveillance Video Management Software 2017 R2, classified under Missing Authorization. CVSS score: 9.8/10. Published 2019-06-12.
- How severe is CVE-2019-6580?
- Critical severity. CVSS v3 base score is 9.8 out of 10.