Auth bypass in Siemens Siveillance Video Management Software 2017 R2
CVE-2019-6582
A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R2 (All versions < V12.2a), Siveillance VMS 2018 R3 (All versions < V12.3a), Siveillance VMS 2019 R1 (All versions < V13.1a). An attacker with network access to port 80/TCP can change user-defined event properties without proper authorization. The security vulnerability could be exploited by an authenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation compromises integrity of the user-defined event properties and the availability of corresponding functionality. At the time of advisory publication no public exploitation of this security vulnerability was known.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L.
EPSS exploit prediction
EPSS: 0.011 (63.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 63.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Siemens Siveillance Video Management Software 2017 R2
- Siemens Siveillance Video Management Software 2018 R1
- Siemens Siveillance Video Management Software 2018 R2
- Siemens Siveillance Video Management Software 2018 R3
- Siemens Siveillance Video Management Software 2019 R1
- Siemens Ag Siveillance Vms 2017 R2 — versions All versions < V11.2a
- Siemens Ag Siveillance Vms 2018 R1 — versions All versions < V12.1a
- Siemens Ag Siveillance Vms 2018 R2 — versions All versions < V12.2a
- Siemens Ag Siveillance Vms 2018 R3 — versions All versions < V12.3a
- Siemens Ag Siveillance Vms 2019 R1 — versions All versions < V13.1a
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf (Patch, Vendor Advisory)
- ics-cert.us-cert.gov/advisories/ICSA-19-162-01 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-6582?
- CVE-2019-6582 is a high-severity vulnerability in Siemens Siveillance Video Management Software 2017 R2, classified under Improper Authorization. CVSS score: 7.1/10. Published 2019-06-12.
- How severe is CVE-2019-6582?
- High severity. CVSS v3 base score is 7.1 out of 10.