Description
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The user configuration menu in the web interface of the
Control Center Server (CCS) transfers user passwords in clear to the
client (browser).
An attacker with administrative privileges for the web interface could be
able to read (and not only reset) passwords of other CCS users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Control Center Server (CCS) | All versions < V1.5.0 | — |
Advisories 3
- ICSA-20-070-01 ICSA-20-070-01_Siemens and PKE SiNVR/SiVMS Video Server (Update B) CISA ICS & IT advisories · Jan 9, 2024
- SSA-761844 SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS) Siemens ProductCERT · Jan 9, 2024
- ICSA-21-103-10 Siemens and PKE Control Center Server CISA ICS & IT advisories · Apr 13, 2021