Read the docs
TI-2019-04634 Aliases CVE-2019-6581GHSA-chmm-53hg-3w2w

Improper authorization in Siemens Siveillance VMS 2017 R2

Priority MEDIUM 41CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R2 (All versions < V12.2a), Siveillance VMS 2018 R3 (All versions < V12.3a), Siveillance VMS 2019 R1 (All versions < V13.1a). An attacker with network access to port 80/TCP could change user roles without proper authorization. The security vulnerability could be exploited by an authenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation compromises confidentiality, integrity and availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Why it matters now

EPSS 0.01268 69th percentileScored 2026-11-07
Fix Fixed Siveillance VMS 2017 R2 (Siemens AG): V11.2aSiveillance VMS 2018 R1 (Siemens AG): V12.1a+3 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSiveillance VMS 2017 R2before V11.2aV11.2aPatch availableCNA
SiemensSiveillance VMS 2018 R1before V12.1aV12.1aPatch availableCNA
SiemensSiveillance VMS 2018 R2before V12.2aV12.2aPatch availableCNA
SiemensSiveillance VMS 2018 R3before V12.3aV12.3aPatch availableCNA
SiemensSiveillance VMS 2019 R1before V13.1aV13.1aPatch availableCNA
  • Siveillance VMS 2017 R2 VendorSiemens Affected before V11.2a Fixed in V11.2a Patch available CNA
  • Siveillance VMS 2018 R1 VendorSiemens Affected before V12.1a Fixed in V12.1a Patch available CNA
  • Siveillance VMS 2018 R2 VendorSiemens Affected before V12.2a Fixed in V12.2a Patch available CNA
  • Siveillance VMS 2018 R3 VendorSiemens Affected before V12.3a Fixed in V12.3a Patch available CNA
  • Siveillance VMS 2019 R1 VendorSiemens Affected before V13.1a Fixed in V13.1a Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:siemens:siveillance_video_management_software_2017_r2:*:*:*:*:*:*:*:*before 11.2aVulnerableSiemens
cpe:2.3:a:siemens:siveillance_video_management_software_2018_r1:*:*:*:*:*:*:*:*before 12.1aVulnerableSiemens
cpe:2.3:a:siemens:siveillance_video_management_software_2018_r2:*:*:*:*:*:*:*:*before 12.2aVulnerableSiemens
cpe:2.3:a:siemens:siveillance_video_management_software_2018_r3:*:*:*:*:*:*:*:*before 12.3aVulnerableSiemens
cpe:2.3:a:siemens:siveillance_video_management_software_2019_r1:*:*:*:*:*:*:*:*before 13.1aVulnerableSiemens
  • cpe:2.3:a:siemens:siveillance_video_management_software_2017_r2:*:*:*:*:*:*:*:* Versions before 11.2a Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_video_management_software_2018_r1:*:*:*:*:*:*:*:* Versions before 12.1a Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_video_management_software_2018_r2:*:*:*:*:*:*:*:* Versions before 12.2a Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_video_management_software_2018_r3:*:*:*:*:*:*:*:* Versions before 12.3a Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_video_management_software_2019_r1:*:*:*:*:*:*:*:* Versions before 13.1a Vulnerable ·Siemens

Remediation

  • Fix · CNA Siveillance VMS 2017 R2 (Siemens AG) Fixed in V11.2a
  • Fix · CNA Siveillance VMS 2018 R1 (Siemens AG) Fixed in V12.1a
  • Fix · CNA Siveillance VMS 2018 R2 (Siemens AG) Fixed in V12.2a
  • Fix · CNA Siveillance VMS 2018 R3 (Siemens AG) Fixed in V12.3a
  • Fix · CNA Siveillance VMS 2019 R1 (Siemens AG) Fixed in V13.1a

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-6581
  2. 2026-10-03 Alias added: GHSA-chmm-53hg-3w2w

References

Patch 1

Advisory 1

  • TI-2019-04633 Missing authorization in Siemens Siveillance VMS 2017 R2 CVSS 3.1CRITICAL 9.8
  • TI-2019-04635 Improper authorization in Siemens Siveillance VMS 2017 R2 CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences