SSA-145196: Authorization Bypass Vulnerability in Siveillance Control
view advisory published 2024-03-12
Siveillance Control does not properly check the list of access groups that are assigned to an individual user. This could enable a locally logged on user to gain write privileges for objects where they only have read privileges. Siemens has released a new version for Siveillance Control and recommends to update to the latest version.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-45793US | —OT elevated | — | ||
A vulnerability has been identified in Siveillance Control (All versions >= V2.8 < V3.1.1). The affected product does not properly check the list of access groups that are assigned… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-145196: Authorization Bypass Vulnerability in Siveillance Control - CSAF Versionself
- SSA-145196: Authorization Bypass Vulnerability in Siveillance Control - HTML Versionself
- SSA-145196: Authorization Bypass Vulnerability in Siveillance Control - PDF Versionself
- SSA-145196: Authorization Bypass Vulnerability in Siveillance Control - TXT Versionself
03
remediations (2)
- MitigationSiveillance Control
Restrict access to the machine where the Siveillance Control frontend is installed
- FixedSiveillance Control
Update to V3.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827073/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan