CVE-2019-6581
mediumpriority · track · 35EPSS 0.013 · 70 %ileEUUSEPSS · scored 2026-10-28
A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R2 (All versions < V12.2a), Siveillance VMS 2018 R3 (All versions < V12.3a), Siveillance VMS 2019 R1 (All versions < V13.1a). An attacker with network access to port 80/TCP could change user roles without proper authorization. The security vulnerability could be exploited by an authenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation compromises confidentiality, integrity and availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSiveillance VMS 2017 R2cisa_csaf_ot
Update to V11.2a - Download: https://support.industry.siemens.com/cs/ww/en/ps/24899/dl
https://support.industry.siemens.com/cs/ww/en/ps/24899/dl - FixedSiveillance VMS 2018 R1cisa_csaf_ot
Update to V12.1a - Download: https://support.industry.siemens.com/cs/ww/en/ps/24899/dl
https://support.industry.siemens.com/cs/ww/en/ps/24899/dl - FixedSiveillance VMS 2018 R2cisa_csaf_ot
Update to V12.2a - Download: https://support.industry.siemens.com/cs/ww/en/ps/24899/dl
https://support.industry.siemens.com/cs/ww/en/ps/24899/dl - FixedSiveillance VMS 2018 R3cisa_csaf_ot
Update to V12.3a - Download: https://support.industry.siemens.com/cs/ww/en/ps/24899/dl
https://support.industry.siemens.com/cs/ww/en/ps/24899/dl - FixedSiveillance VMS 2019 R1cisa_csaf_ot
Update to V13.1a - Download: https://support.industry.siemens.com/cs/ww/en/ps/24899/dl
https://support.industry.siemens.com/cs/ww/en/ps/24899/dl - MitigationSiveillance VMS 2017 R2cisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block port 80/TCP at an external firewall.
- MitigationSiveillance VMS 2018 R1cisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block port 80/TCP at an external firewall.
- MitigationSiveillance VMS 2018 R2cisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block port 80/TCP at an external firewall.
- MitigationSiveillance VMS 2018 R3cisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block port 80/TCP at an external firewall.
- MitigationSiveillance VMS 2019 R1cisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block port 80/TCP at an external firewall.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (20)
Products and version ranges known to be affected.
- siemens siveillance video management software 2017 r2< 11.2anvdUScpe:2.3:a:siemens:siveillance_video_management_software_2017_r2:*:*:*:*:*:*:*:*
- siemens siveillance video management software 2018 r1< 12.1anvdUScpe:2.3:a:siemens:siveillance_video_management_software_2018_r1:*:*:*:*:*:*:*:*
- siemens siveillance video management software 2018 r2< 12.2anvdUScpe:2.3:a:siemens:siveillance_video_management_software_2018_r2:*:*:*:*:*:*:*:*
- siemens siveillance video management software 2018 r3< 12.3anvdUScpe:2.3:a:siemens:siveillance_video_management_software_2018_r3:*:*:*:*:*:*:*:*
- siemens siveillance video management software 2019 r1< 13.1anvdUScpe:2.3:a:siemens:siveillance_video_management_software_2019_r1:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-19-162-01ICSA-19-162-01 Siemens Siveillance VMS2019-06-11icsa · cisa_csaf_otUS
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- http://subscriber.communications.siemens.com/cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdfcnnvd
- https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.2095/cnnvd
- https://www.securityfocus.com/bid/108727cnnvd
- https://www.siemens.com/Patchcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdfenisa_euvd
- https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan