Siemens ProductCERT Patch Day — December 2019

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 3

• Critical 9.9
  CVE-2019-18342 A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server…
  EPSS 2.1%
• Critical 9.8
  CVE-2019-18337 A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an authentication bypass v…
  EPSS 2.5%
• Critical 9.8
  CVE-2019-18339 A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port 5401/tcp) of the SiVMS/SiNVR Video Serv…
  EPSS 2.7%

All vulnerabilities 68