NewsSiemens ProductCERT

    SSA-761844 V1.0: Multiple Vulnerabilities in Control Center Server (CCS)

    The advisory informs about multiple vulnerabilities in the Central Control Server (CCS) application, as initially reported in SSA-761617 on 2019-12-10 and SSA-844761 on 2020-03-10. The vulnerabilities involve authentication bypass (CVE-2019-18337, CVE-2019-18341), path traversal (CVE-2019-18338, CVE-2019-19290), information disclosure (CVE-2019-13947, CVE-2019-18340, CVE-2019-19291), privilege escalation (CVE-2019-18342), SQL injection (CVE-2019-19292), cross-site scripting (CVE-2019-19293, CVE-2019-19294), and insufficient logging (CVE-2019-19295). PKE has released an update for CCS that fixes the reported vulnerabilities, except for CVE-2019-18340. For details see the PKE Security Advisory at https://sivms.cloud/wp-content/uploads/2021/03/sivms-cve-fixes_1.0_EN.pdf Siemens recommends to update to the latest version and recommends specific countermeasures to mitigate the vulnerabilities.

    Linked advisories

    Affected vendors and products

    More on SSA-761844

    Other news entries

    Source: https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf

    ID