Multiple Access Control Vulnerabilities in SiPass Integrated
Plan Patch7.5SSA-160202Dec 14, 2021
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
SiPass integrated contains multiple access control vulnerabilities (CWE-668) that allow an unauthenticated remote attacker to access or modify internal application resources. Affected versions include V2.76, V2.80, and V2.85. Siemens has provided a remediation tool (SiPass integrated Component Manager) for supported versions rather than traditional security patches.
What this means
What could happen
An attacker could remotely access or modify security-related data in SiPass integrated without logging in, potentially compromising building access control and security policies across multiple properties or facilities managed by the system.
Who's at risk
Organizations operating Siemens SiPass integrated building access control systems, particularly large enterprises, healthcare facilities, government buildings, and data centers with multiple facilities or properties managed through a centralized SiPass installation running versions V2.76, V2.80, or V2.85.
How it could be exploited
An attacker sends unauthenticated HTTP requests to the SiPass integrated application server over the network to access or modify internal application resources. No credentials, authentication bypass, or additional complexity is required—the vulnerability exists in the application's access control logic itself.
Prerequisites
- Network connectivity to the SiPass integrated application server (typically port 80/443)
- SiPass integrated running on affected versions (V2.76, V2.80, or V2.85)
remotely exploitableno authentication requiredlow complexityaffects safety systemsaccess control bypass potential
Exploitability
Low exploit probability (EPSS 0.6%)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
SiPass integrated V2.76All versionsV2.76 SP2 + Component Manager tool
SiPass integrated V2.85All versionsComponent Manager tool
SiPass integrated V2.80All versionsComponent Manager tool
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDRestrict network access to the SiPass integrated application server to authorized administration networks only using firewall rules or network segmentation
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXDownload and execute the SiPass integrated Component Manager tool from Siemens support (https://support.industry.siemens.com/cs/ww/en/view/109802587/) on all SiPass integrated servers
HOTFIXFor V2.76 systems, update to V2.76 SP2 before applying the Component Manager tool
Long-term hardening
0/1HARDENINGImplement network segmentation to isolate SiPass integrated servers on a dedicated building security network segment separate from general IT and guest networks
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/6d72d06f-703f-48d8-9739-42d1fd891133