Summary
Several camera device drivers in the Siveillance Video Device Pack store camera credentials in their log file when authentication fails. This could allow a local attacker to read camera credentials stored in the Recording Server under specific conditions.
Siemens has released an update of the Device Pack and recommends to apply this update to all deployments of Siveillance Video. In general, Siemens recommends installing the latest Device Pack which contains the most up-to-date device drivers.
Vulnerabilities 1
-
High 7.8
Sensitive Information in Driver’s Log File
Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credentials stored in the Recording Server under specific conditions.
Revision history
-
#2
Updated CVE-2024-12569 with changed description according to https://www.cve.org/CVERecord?id=CVE-2024-12569
-
#1
Publication Date
References
-
SSA-404759: Information Disclosure Vulnerability in Siveillance Video Camera Drivers - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-404759.html