Summary
The Siveillance Open Interface Services (OIS) application used for integration of different subsystems to several Siemens building management systems contains a command injection vulnerability that could allow a remote unauthenticated attacker to execute code on the affected system with root privileges.
Siemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions wi…
Revision history
-
#2
Revision - Fixing typos
-
#1
Publication Date
References
-
SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-535380.txt
-
SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf
-
ICS Advisory ICSA-21-257-18 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-257-18
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B