CVE-2019-13947
mediumPriorität · verfolgen · 20OT-Risiko · erhöhtEPSS 0.009 · 58. PerzentilDEEUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The user configuration menu in the web interface of the Control Center Server (CCS) transfers user passwords in clear to the client (browser). An attacker with administrative privileges for the web interface could be able to read (and not only reset) passwords of other CCS users.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenControl Center Server (CCS)siemens_psirt
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)cisa_csaf_ot
Update to V1.5.0 or later version
- BehobenControl Center Server (CCS)cisa_csaf_ot
Update to V1.5.0 or later version
https://sivms.cloud/control-center-server-ccs/ - MitigationControl Center Server (CCS)siemens_psirt
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)cisa_csaf_ot
Apply ACL/firewall configuration on the CCS server to ensure that only legitimate systems are able to access the configured CCS server ports. Harden the CCS server accordingly to prevent unauthorized access. Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- MitigationControl Center Server (CCS)cisa_csaf_ot
As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (6)
Betroffene Produkte und Versionsbereiche.
- siemens sinvr 3 central control serveralle VersionennvdUScpe:2.3:a:siemens:sinvr_3_central_control_server:*:*:*:*:*:*:*:*
- siemens sinvr 3 video serveralle VersionennvdUScpe:2.3:a:siemens:sinvr_3_video_server:*:*:*:*:*:*:*:*
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-761844SSA-761844: Multiple Vulnerabilities in Control Center Server (CCS)2021-04-13csaf · siemens_psirtDE
The advisory informs about multiple vulnerabilities in the Central Control Server (CCS) application, as initially reported in SSA-761617 ( https://cert-portal.siemens.com/productcert/html/ssa-761617.html) on 2019-12-10 and SSA-844761 (https://cert-portal.siemens.com/productcert/html/ssa-844761.html) on 2020-03-10. The vulnerabilities involve authentication bypass (CVE-2019-18337, CVE-2019-18341), path traversal (CVE-2019-18338, CVE-2019-19290), information disclosure (CVE-2019-13947, CVE-2019-18340, CVE-2019-19291), privilege escalation (CVE-2019-18342), SQL injection (CVE-2019-19292), cross-site scripting (CVE-2019-19293, CVE-2019-19294), and insufficient logging (CVE-2019-19295). PKE has released an update for CCS that fixes the reported vulnerabilities, except for CVE-2019-18340. For details contact PKE ( https://pke.at/). Siemens recommends to update to the latest version and recommends specific countermeasures to mitigate the vulnerabilities.
- ICSA-20-070-01ICSA-20-070-01_Siemens and PKE SiNVR/SiVMS Video Server (Update B)2021-04-13icsa · cisa_csaf_otUS
The advisory informs about multiple vulnerabilities in the Central Control Server (CCS) application, as initially reported in SSA-761617 ( https://cert-portal.siemens.com/productcert/html/ssa-761617.html) on 2019-12-10 and SSA-844761 (https://cert-portal.siemens.com/productcert/html/ssa-844761.html) on 2020-03-10. The vulnerabilities involve authentication bypass (CVE-2019-18337, CVE-2019-18341), path traversal (CVE-2019-18338, CVE-2019-19290), information disclosure (CVE-2019-13947, CVE-2019-18340, CVE-2019-19291), privilege escalation (CVE-2019-18342), SQL injection (CVE-2019-19292), cross-site scripting (CVE-2019-19293, CVE-2019-19294), and insufficient logging (CVE-2019-19295). PKE has released an update for CCS that fixes the reported vulnerabilities, except for CVE-2019-18340. For details contact PKE ( https://pke.at/). Siemens recommends to update to the latest version and recommends specific countermeasures to mitigate the vulnerabilities.
- ICSA-21-103-10Siemens and PKE Control Center Server2021-04-13icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow an attacker to read and write arbitrary files and sensitive data and execute commands and arbitrary code.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-13947cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-103-10cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.4625/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.1240cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021041517cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-19-344-02cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan