Description
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal message broker system. This could allow an unauthenticated remote attacker to subscribe to arbitrary message queues.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SiPass integrated V2.76 | All versions | — |
| Siemens | SiPass integrated V2.80 | All versions | — |
| Siemens | SiPass integrated V2.85 | All versions | — |
| Siemens | Siveillance Identity V1.5 | All versions | — |
| Siemens | Siveillance Identity V1.6 | All versions < V1.6.284.0 | — |
Advisories 4
- ICSA-21-350-19 Siemens SiPass Integrated CISA ICS & IT advisories · May 6, 2025
- ICSA-21-350-14 Siemens Siveillance Identity CISA ICS & IT advisories · May 6, 2025
- SSA-160202 SSA-160202: Multiple Access Control Vulnerabilities in SiPass Integrated Siemens ProductCERT · Dec 14, 2021
- SSA-463116 SSA-463116: Multiple Access Control Vulnerabilities in Siveillance Identity before V1.6.284.0 Siemens ProductCERT · Dec 14, 2021