SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems
The Siveillance Open Interface Services (OIS) application used for integration of different subsystems to several Siemens building management systems contains a command injection vulnerability that could allow a remote unauthenticated attacker to execute code on the affected system with root privileges. Siemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-31891US | critical10.0 | — | ||
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (… | ||||
references
External citations — patches, advisories, analysis.
- SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - CSAF Versionself
- SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - PDF Versionself
- SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - TXT Versionself
remediations (10)
- MitigationDesigo CC
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- MitigationGMA-Manager
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- MitigationOperation Scheduler
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- MitigationSiveillance Control
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- MitigationSiveillance Control Pro
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- FixedDesigo CC
Update the OIS to V2.5.3 or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/ - FixedGMA-Manager
Update the OIS to V2.5.3 or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/ - FixedOperation Scheduler
Update the OIS to V2.5.3 or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/ - FixedSiveillance Control
Update the OIS to V2.5.3 or V2.6.1, or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/ - FixedSiveillance Control Pro
Update the OIS to V2.5.3 or V2.6.0, or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan