8.8

CVE-2021-27392

A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Siveillance Video Open Network Bridge Version 2018 Update r2
Siemens ≫ Siveillance Video Open Network Bridge Version 2018 Update r3
Siemens ≫ Siveillance Video Open Network Bridge Version 2019 Update r1
Siemens ≫ Siveillance Video Open Network Bridge Version 2019 Update r2
Siemens ≫ Siveillance Video Open Network Bridge Version 2019 Update r3
Siemens ≫ Siveillance Video Open Network Bridge Version 2020 Update r1
Siemens ≫ Siveillance Video Open Network Bridge Version 2020 Update r2
Siemens ≫ Siveillance Video Open Network Bridge Version 2020 Update r3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.18% 0.637
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-321 Use of Hard-coded Cryptographic Key

The product uses a hard-coded, unchangeable cryptographic key.

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf
Vendor Advisory