Siemens Siveillance OIS
The Siveillance Open Interface Services (OIS) application used for integration of different subsystems to several Siemens building management systems contains a command injection vulnerability that could allow a remote unauthenticated attacker to execute code on the affected system with root privileges. Siemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-31891US | critical10.0 | — | ||
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - CSAF Versionself
- SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - PDF Versionself
- SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - TXT Versionself
- ICS Advisory ICSA-21-257-18 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-257-18 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (10)
- MitigationDesigo CC
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- MitigationGMA-Manager
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- MitigationOperation Scheduler
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- MitigationSiveillance Control
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- MitigationSiveillance Control Pro
Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel
- BehobenDesigo CC
Update the OIS to V2.5.3 or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/ - BehobenGMA-Manager
Update the OIS to V2.5.3 or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/ - BehobenOperation Scheduler
Update the OIS to V2.5.3 or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/ - BehobenSiveillance Control
Update the OIS to V2.5.3 or V2.6.1, or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/ - BehobenSiveillance Control Pro
Update the OIS to V2.5.3 or V2.6.0, or apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109799908/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan