Description
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0). Both the SiVMS/SiNVR Video Server and the Control Center Server (CCS) store
user and device passwords by applying weak cryptography.
A local attacker could exploit this vulnerability to extract
the passwords from the user database and/or the device configuration files
to conduct further attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Control Center Server (CCS) | All versions < V1.5.0, All versions >= V1.5.0 | — |
| Siemens | SiNVR/SiVMS Video Server | All versions < V5.0.0, All versions >= V5.0.0 | — |
Advisories 5
- ICSA-20-070-01 ICSA-20-070-01_Siemens and PKE SiNVR/SiVMS Video Server (Update B) CISA ICS & IT advisories · Jan 9, 2024
- SSA-761617 SSA-761617: Authentication Bypass and Information Disclosure Vulnerabilities in SiNVR/SiVMS Video Server Siemens ProductCERT · Jan 9, 2024
- SSA-761844 SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS) Siemens ProductCERT · Jan 9, 2024
- ICSA-21-103-10 Siemens and PKE Control Center Server CISA ICS & IT advisories · Apr 13, 2021
- ICSA-19-344-02 Siemens and PKE SiNVR, SiVMS Video Server (Update A) CISA ICS & IT advisories · Apr 13, 2021