SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS)
The advisory informs about multiple vulnerabilities in the Central Control Server (CCS) application, as initially reported in SSA-761617 ( https://cert-portal.siemens.com/productcert/html/ssa-761617.html) on 2019-12-10 and SSA-844761 (https://cert-portal.siemens.com/productcert/html/ssa-844761.html) on 2020-03-10. The vulnerabilities involve authentication bypass (CVE-2019-18337, CVE-2019-18341), path traversal (CVE-2019-18338, CVE-2019-19290), information disclosure (CVE-2019-13947, CVE-2019-18340, CVE-2019-19291), privilege escalation (CVE-2019-18342), SQL injection (CVE-2019-19292), cross-site scripting (CVE-2019-19293, CVE-2019-19294), and insufficient logging (CVE-2019-19295). PKE has released an update for CCS that fixes the reported vulnerabilities, except for CVE-2019-18340. For details contact PKE ( https://pke.at/). Siemens recommends to update to the latest version and recommends specific countermeasures to mitigate the vulnerabilities.
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-19295US | medium4.3 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) does not enforce logging of
security-relevant activities… | ||||
| CVE-2019-19294US | low3.5 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Control Center Server (CCS) contains
multiple stored Cross-site… | ||||
| CVE-2019-19293US | medium4.3 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Control Center Server (CCS) contains a
reflected Cross-site Scr… | ||||
| CVE-2019-19292US | medium6.5 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an SQL injection
vulnerability in its XML-based… | ||||
| CVE-2019-19291US | low3.5OT erhöht | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0). The FTP services of the SiVMS/SiNVR Vi… | ||||
| CVE-2019-19290US | medium4.0 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The DOWNLOADS section in the web interface of the Control Center
Server (CCS) contains a… | ||||
| CVE-2019-18342US | high7.5 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server
(CCS) does not prope… | ||||
| CVE-2019-18341US | medium5.0 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server
(CCS) contains an au… | ||||
| CVE-2019-18340US | low2.1OT erhöht | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS Video Server (All vers… | ||||
| CVE-2019-18338US | medium4.0 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains a directory traversal
vulnerability in its XML-… | ||||
| CVE-2019-18337US | medium5.0 | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an authentication bypass
vulnerability in its X… | ||||
| CVE-2019-13947US | medium4.9OT erhöht | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The user configuration menu in the web interface of the
Control Center Server (CCS) tran… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS) - CSAF Versionself
- SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS) - HTML Versionself
- SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS) - PDF Versionself
- SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS) - TXT Versionself
Behebungen (25)
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- Kein Fix geplantControl Center Server (CCS)
Currently no fix is planned
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)
Update to V1.5.0 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan