Summary
Siveillance Video Management Servers contains a vulnerability that could allow a Remote Code Execution attack.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
Critical 9.1
Remote Code Execution by administrative user on the Management Server
Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary c…
Revision history
-
#2
Initial CISA Republication of Siemens SSA-825228 advisory
-
#1
Publication Date
References
-
SSA-825228: Potential Remote Code Execution in Siveillance Video Management Servers - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-825228.html
-
ICS Advisory ICSA-26-225-09 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-09
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b