Critical ICSA-21-103-10 12 CVEs

Siemens and PKE Control Center Server

Published Apr 13, 2021 · Updated Apr 13, 2021

Vendor: Siemens Product: Control Center Server (CCS)

Summary

Successful exploitation of these vulnerabilities may allow an attacker to read and write arbitrary files and sensitive data and execute commands and arbitrary code.

Vulnerabilities 12

Critical 9.9

CVE-2019-18342

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default p…

Siemens Control Center Server (CCS) ICS / OT

Dec 12, 2019
Critical 9.8

CVE-2019-18337

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (…

Siemens Control Center Server (CCS) ICS / OT

Dec 12, 2019
High 8.8

CVE-2019-19292

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (…

Siemens Control Center Server (CCS) ICS / OT

Mar 10, 2020
High 7.7

CVE-2019-18338

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (…

Siemens Control Center Server (CCS) ICS / OT

Dec 12, 2019
Medium 6.5

CVE-2019-19290

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The DOWNLOADS section in th…

Siemens Control Center Server (CCS) ICS / OT

Mar 10, 2020
Medium 6.3

CVE-2019-19294

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Co…

Siemens Control Center Server (CCS) ICS / OT

Mar 10, 2020
Medium 6.1

CVE-2019-19293

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Co…

Siemens Control Center Server (CCS) ICS / OT

Mar 10, 2020
Medium 5.5

CVE-2019-18340

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS)…

Siemens Control Center Server (CCS) SiNVR/SiVMS Video Server ICS / OT

Dec 12, 2019
Medium 5.3

CVE-2019-18341

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default p…

Siemens Control Center Server (CCS) ICS / OT

Dec 12, 2019
Medium 5.3

CVE-2019-19291

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), SiNVR/SiVMS Video Server (A…

Siemens Control Center Server (CCS) SiNVR/SiVMS Video Server ICS / OT

Mar 10, 2020
Medium 4.9

CVE-2019-13947

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The user configuration menu…

Siemens Control Center Server (CCS) ICS / OT

Dec 12, 2019
Medium 4.3

CVE-2019-19295

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (…

Siemens Control Center Server (CCS) ICS / OT

Mar 10, 2020

Revision history

2021-04-13 #1
ICSA-21-103-10 Siemens / PKE Control Center Server

References

ICS Advisory ICSA-21-103-10 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-103-10
Recommended Practices
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B
SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS) - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf
SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS) - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-761844.txt