CVE-2023-30899 - Vulnerability Details - OpenCVE

A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Siemens	Siveillance Video

Configuration 1 [-]

OR	cpe:2.3:a:siemens:siveillance_video:2020:r2::::::
	cpe:2.3:a:siemens:siveillance_video:2020:r3::::::
	cpe:2.3:a:siemens:siveillance_video:2021:r1::::::
	cpe:2.3:a:siemens:siveillance_video:2021:r2::::::
	cpe:2.3:a:siemens:siveillance_video:2022:r1::::::
	cpe:2.3:a:siemens:siveillance_video:2022:r2::::::
	cpe:2.3:a:siemens:siveillance_video:2022:r3::::::
	cpe:2.3:a:siemens:siveillance_video:2023:r1::::::

No data.

References

Link	Providers
https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf

History

Tue, 28 Jan 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: siemens

Published: 2023-05-09T11:51:37.547Z

Updated: 2025-01-28T17:34:19.244Z

Reserved: 2023-04-20T12:49:01.866Z

Link: CVE-2023-30899

Vulnrichment

Updated: 2024-08-02T14:37:15.561Z

NVD

Status : Modified

Published: 2023-05-09T13:15:18.183

Modified: 2024-11-21T08:01:01.803

Link: CVE-2023-30899

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-30899", "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "state": "PUBLISHED", "assignerShortName": "siemens", "dateReserved": "2023-04-20T12:49:01.866Z", "datePublished": "2023-05-09T11:51:37.547Z", "dateUpdated": "2025-01-28T17:34:19.244Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens", "dateUpdated": "2023-05-09T11:51:37.547Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system."}], "affected": [{"vendor": "Siemens", "product": "Siveillance Video 2020 R2", "versions": [{"version": "All versions < V20.2 HotfixRev14", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2020 R3", "versions": [{"version": "All versions < V20.3 HotfixRev12", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2021 R1", "versions": [{"version": "All versions < V21.1 HotfixRev12", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2021 R2", "versions": [{"version": "All versions < V21.2 HotfixRev8", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2022 R1", "versions": [{"version": "All versions < V22.1 HotfixRev7", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2022 R2", "versions": [{"version": "All versions < V22.2 HotfixRev5", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2022 R3", "versions": [{"version": "All versions < V22.3 HotfixRev2", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2023 R1", "versions": [{"version": "All versions < V23.1 HotfixRev1", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:37:15.561Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-28T17:33:33.839414Z", "id": "CVE-2023-30899", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-28T17:34:19.244Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:37:15.561Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-30899", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-28T17:33:33.839414Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-28T17:33:45.231Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C"}}], "affected": [{"vendor": "Siemens", "product": "Siveillance Video 2020 R2", "versions": [{"status": "affected", "version": "All versions < V20.2 HotfixRev14"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2020 R3", "versions": [{"status": "affected", "version": "All versions < V20.3 HotfixRev12"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2021 R1", "versions": [{"status": "affected", "version": "All versions < V21.1 HotfixRev12"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2021 R2", "versions": [{"status": "affected", "version": "All versions < V21.2 HotfixRev8"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2022 R1", "versions": [{"status": "affected", "version": "All versions < V22.1 HotfixRev7"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2022 R2", "versions": [{"status": "affected", "version": "All versions < V22.2 HotfixRev5"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2022 R3", "versions": [{"status": "affected", "version": "All versions < V22.3 HotfixRev2"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Siveillance Video 2023 R1", "versions": [{"status": "affected", "version": "All versions < V23.1 HotfixRev1"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens", "dateUpdated": "2023-05-09T11:51:37.547Z"}}}, "cveMetadata": {"cveId": "CVE-2023-30899", "state": "PUBLISHED", "dateUpdated": "2025-01-28T17:34:19.244Z", "dateReserved": "2023-04-20T12:49:01.866Z", "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "datePublished": "2023-05-09T11:51:37.547Z", "assignerShortName": "siemens"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:siveillance_video:2020:r2:*:*:*:*:*:*", "matchCriteriaId": "1A37DE78-2274-4A7E-9C88-6BCC3385EB8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video:2020:r3:*:*:*:*:*:*", "matchCriteriaId": "6FFC3116-F2BD-4AFF-9700-F9CA306D37D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video:2021:r1:*:*:*:*:*:*", "matchCriteriaId": "9AF92046-F73F-4128-9EDB-993856B9880F", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video:2021:r2:*:*:*:*:*:*", "matchCriteriaId": "CE398796-4965-446D-A318-2E37DF0D653B", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video:2022:r1:*:*:*:*:*:*", "matchCriteriaId": "6F4A6472-67AE-41E0-9778-F698F8489F48", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video:2022:r2:*:*:*:*:*:*", "matchCriteriaId": "5B5D26B1-8D4B-418F-88F6-95AB26F4CEF0", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video:2022:r3:*:*:*:*:*:*", "matchCriteriaId": "04958C83-36AF-4365-B94B-56D307F14A41", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video:2023:r1:*:*:*:*:*:*", "matchCriteriaId": "5C1C3E3C-16FE-4215-AFC6-DECCDEA858EB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system."}], "id": "CVE-2023-30899", "lastModified": "2024-11-21T08:01:01.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "productcert@siemens.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-09T13:15:18.183", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "productcert@siemens.com", "type": "Secondary"}]}