Authorization Bypass Vulnerability in Siveillance Control
Monitor5.5SSA-145196Mar 12, 2024
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Siveillance Control versions 2.8 through 3.1.0 do not properly validate the list of access groups assigned to individual users. This vulnerability allows a locally authenticated user with read-only permissions to gain write access to monitored objects, potentially enabling unauthorized modifications to surveillance configurations or recordings. The issue stems from incomplete access group verification during privilege evaluation.
What this means
What could happen
A user who is logged into Siveillance Control but granted only read access to critical monitoring objects could gain write privileges, potentially allowing them to alter surveillance configurations, disable monitoring, or modify recordings of critical infrastructure activities.
Who's at risk
Organizations managing critical infrastructure surveillance systems using Siemens Siveillance Control should prioritize this update. This applies to water utilities, electric utilities, transportation authorities, and other facilities using Siveillance for physical security monitoring and incident recording.
How it could be exploited
An attacker with local access and a user account on the Siveillance Control system (even with limited read-only permissions) can exploit incomplete access group validation to escalate their privileges to write access. This allows them to modify monitoring settings or disable surveillance without proper authorization checks.
Prerequisites
- Local access to the Siveillance Control system
- Valid user account on the system (even read-only)
- No network access required
Local access requiredPrivilege escalation attackAffects access controlsImpacts audit trail integrity
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
Siveillance Control≥ V2.8<V3.1.13.1.1
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Siveillance Control to version 3.1.1 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/09e8d08e-9d61-4bb8-aedf-989949b52562