Main Vulnerability Database Vulnerabilities #VU18810

Improper Authorization in Siemens products - CVE-2019-6580

Published: June 17, 2019 / Updated: July 1, 2019

Vulnerability identifier: #VU18810

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6580

CWE-ID: CWE-285

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to change device properties.

The vulnerability exist due to missing authorization on a Port 80/TCP. An attacker with network access to Port 80/TCP can change device properties without authorization.

Affected software

Siveillance VMS 2019 R1
Siveillance VMS 2018 R3
Siveillance VMS 2018 R2
Siveillance VMS 2018 R1
Siveillance VMS 2017 R2

How to mitigate CVE-2019-6580

Install updates from vendor's website.

Siveillance VMS 2019 R1 - update to 13.1a
Siveillance VMS 2018 R3 - update to 12.3a
Siveillance VMS 2018 R2 - update to 12.2a
Siveillance VMS 2018 R1 - update to 12.1a
Siveillance VMS 2017 R2 - update to 11.2a

External References

Related Security Bulletins

Multiple vulnerabilities in Siemens Siveillance VMS