Siemens and PKE Control Center Server

🗓️ 13 Apr 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 37 Views

Siemens PKE Control Center Server vulnerabilities include cleartext storage of sensitive information, improper authentication, relative path traversal, use of broken cryptographic algorithm, exposed dangerous method

Reporter	Title	Published	Views	Family All 114
BDU FSTEC	The vulnerability of the central control server of SiNVR 3 Central Control Server (CCS) arises from an incorrect path name limitation in the web interface download section, which allows a hacker to gain access to the server’s file system, enabling them to download files from the server and copy files from the server.	29 May 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Central Control Server (CCS) and the Video Server of Siemens’ SiNVR 3 solution, related to the unencrypted storage of user credentials, allows a intruder to gain unauthorized access to users’ credentials.	29 May 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the central control server of SiNVR 3 allows a hacker to read or modify the database of the central control server, as well as perform operations on the databases or operating system commands with administrator privileges.	29 May 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the central control server of SiNVR 3 Central Control Server lies in the lack of measures for cleaning incoming data. This allows a intruder to gain unauthorized access to protected information or perform arbitrary actions on the vulnerable device.	29 May 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Central Control Server (CCS) and the Video Server of Siemens’ SiNVR 3 solution, related to the lack of measures for cleaning input data, allows a intruder to inject malicious code into the web application of the Central Control Server.	29 May 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the central control server of SiNVR 3 Central Control Server lies in security flaws in the XML-based communication protocol, allowing attackers to perform arbitrary actions on the vulnerable device.	29 May 202000:00	–	bdu_fstec
Circl	CVE-2019-13947	11 Mar 202409:41	–	circl
Circl	CVE-2019-18337	11 Mar 202414:46	–	circl
Circl	CVE-2019-18338	11 Mar 202414:46	–	circl
Circl	CVE-2019-18340	11 Mar 202414:46	–	circl

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/csaf/ssa-761844.json
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-103-10.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-103-10
us-cert	www.us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf
cert-portal	www.cert-portal.siemens.com/productcert/txt/ssa-761844.txt

13 Apr 2021 00:00Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.19.8 - 9.9

EPSS0.02647

SSVC