Siemens Siveillance Video
Monitor5.5ICS-CERT ICSA-25-140-05May 14, 2025
Attack VectorNetwork
Auth RequiredHigh
ComplexityHigh
User InteractionNone needed
Summary
The installer for Siveillance Video V2024 R1 resets the system configuration password when upgrading from older versions, which removes password protection from system configuration files and backup datasets. This affects Siveillance Video versions V24.1 and later. The vulnerability has a CVSS score of 5.5 (low confidentiality and integrity impact) and attack complexity is high. No vendor fix is planned for this issue.
What this means
What could happen
An attacker with access to the system configuration files could read sensitive configuration data if the password protection was removed during an update to V2024 R1. This could expose credentials or process parameters stored in backup data sets.
Who's at risk
Video surveillance system administrators operating Siemens Siveillance Video V2024 R1 that were upgraded from older versions. This affects any facility using Siveillance Video for security camera recording and management, including water utilities, electrical utilities, and other infrastructure operators that rely on video monitoring for facility security.
How it could be exploited
An attacker with local or network access to configuration files on a Siveillance Video system that was updated to V2024 R1 could read system configuration and backup data without authentication, since the installer may have reset the password protection. The attacker needs to know the system uses V2024 R1 and was upgraded from an older version.
Prerequisites
- Local or network access to Siveillance Video configuration file storage
- System must have been upgraded from a pre-V2024 R1 version to V2024 R1
- Configuration password protection must not have been re-enabled after the update
no authentication required to read configuration files after updatehigh attack complexitynot actively exploitedaffects configuration and backup data confidentiality
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (1)
ProductAffected VersionsFix Status
Siveillance Video≥ V24.1No fix (EOL)
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDChange the system configuration password settings for all Siveillance Video V2024 R1 systems that were updated from older versions (see Siveillance Video 2024 R1 Administrator Manual page 268)
Mitigations - no patch available
0/2Siveillance Video has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGImplement network access controls to restrict access to Siveillance Video systems from untrusted networks using firewalls and network segmentation
HARDENINGImplement local access controls to restrict physical or administrative access to configuration file storage directories
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/79d2d0bc-1b43-4846-94ad-1ae06e0501bd