Improper Authorization in Siemens products - CVE-2019-6582

Vulnerability identifier: #VU18812

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6582

CWE-ID: CWE-285

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to change user-defined event properties.

The vulnerability exist due to missing authorization on a Port 80/TCP. An authenticated attacker with network access to Port 80/TCP can change user-defined event properties without proper authorization.

Siveillance VMS 2019 R1
Siveillance VMS 2018 R3
Siveillance VMS 2018 R2
Siveillance VMS 2018 R1
Siveillance VMS 2017 R2

Install updates from vendor's website.

Siveillance VMS 2019 R1 - update to 13.1a
Siveillance VMS 2018 R3 - update to 12.3a
Siveillance VMS 2018 R2 - update to 12.2a
Siveillance VMS 2018 R1 - update to 12.1a
Siveillance VMS 2017 R2 - update to 11.2a

• https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf
• https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01

• Multiple vulnerabilities in Siemens Siveillance VMS