Multiple Access Control Vulnerabilities in Siveillance Identity before V1.6.284.0

An attacker could access or modify internal application resources in your Siveillance Identity system without credentials, potentially compromising identity and access control data used to manage facility security systems.

Facilities operators and security teams running Siemens Siveillance Identity V1.5 or V1.6 (before V1.6.284.0) should prioritize this. Siveillance Identity is commonly used in access control, security integration, and identity management systems in water utilities, power plants, and other critical infrastructure facilities.

An unauthenticated attacker on the network sends requests to Siveillance Identity to directly access or modify internal application resources that should be protected by access controls. The lack of proper authentication checks allows the attacker to read sensitive data or alter access control configurations.