Siemens Siveillance Video Management Servers
The Webhooks implementation of Siveillance Video Management Servers contains a vulnerability that could allow an authenticated remote attacker with read-only privileges to achieve full access to Webhooks API. Siemens has released new versions for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-0836US | —OT erhöht | — | ||
Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-625934: Improper Access Control Vulnerability in the Webhooks Implementation of Siveillance Video Management Servers - CSAF Versionself
- SSA-625934: Improper Access Control Vulnerability in the Webhooks Implementation of Siveillance Video Management Servers - HTML Versionself
- ICS Advisory ICSA-26-043-07 JSONself
- ICS Advisory ICSA-26-043-07 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (10)
- MitigationSiveillance Video V2023 R1
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- MitigationSiveillance Video V2023 R2
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- MitigationSiveillance Video V2023 R3
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- MitigationSiveillance Video V2024 R1
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- MitigationSiveillance Video V2025
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- BehobenSiveillance Video V2023 R1
Update to V23.1 HotfixRev18 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820659/ - BehobenSiveillance Video V2023 R2
Update to V23.2 HotfixRev18 or later version
https://support.industry.siemens.com/cs/ww/en/view/109823922/ - BehobenSiveillance Video V2023 R3
Update to V23.3 HotfixRev23 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827783/ - BehobenSiveillance Video V2024 R1
Update to V24.1 HotfixRev14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109976123/ - BehobenSiveillance Video V2025
Update to V25.1 HotfixRev8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109988670/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan