Siemens SiPass Integrated

An attacker with access to the backup restore function could upload a malicious backup file to execute arbitrary code on the SiPass integrated server, potentially compromising access control system operations and compromising security of facilities relying on SiPass for badge access and authentication.

Organizations operating Siemens SiPass integrated access control systems, particularly in building security, government facilities, and critical infrastructure sectors that rely on integrated badge access and authentication. The risk is highest for facilities where backup restore operations are performed or where the Configuration Client is exposed to less-trusted personnel.

An attacker with the ability to initiate a restore operation (or trick an authorized person into doing so) uploads a specially crafted backup file. When the server processes the backup during restore, the directory traversal in DotNetZip allows code execution on the application server.