Hard-coded credentials in Siemens Siveillance Video Open Network Bridge
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.
Summary
A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Siveillance Video Open Network Bridge | 2020 R3 | — | No fix listed | CNA |
| Siemens | Siveillance Video Open Network Bridge | 2020 R2 | — | No fix listed | CNA |
| Siemens | Siveillance Video Open Network Bridge | 2020 R1 | — | No fix listed | CNA |
| Siemens | Siveillance Video Open Network Bridge | 2019 R3 | — | No fix listed | CNA |
| Siemens | Siveillance Video Open Network Bridge | 2019 R2 | — | No fix listed | CNA |
| Siemens | Siveillance Video Open Network Bridge | 2019 R1 | — | No fix listed | CNA |
| Siemens | Siveillance Video Open Network Bridge | 2018 R3 | — | No fix listed | CNA |
| Siemens | Siveillance Video Open Network Bridge | 2018 R2 | — | No fix listed | CNA |
- Siveillance Video Open Network Bridge VendorSiemens Affected 2020 R3 Fixed in — No fix listed CNA
- Siveillance Video Open Network Bridge VendorSiemens Affected 2020 R2 Fixed in — No fix listed CNA
- Siveillance Video Open Network Bridge VendorSiemens Affected 2020 R1 Fixed in — No fix listed CNA
- Siveillance Video Open Network Bridge VendorSiemens Affected 2019 R3 Fixed in — No fix listed CNA
- Siveillance Video Open Network Bridge VendorSiemens Affected 2019 R2 Fixed in — No fix listed CNA
- Siveillance Video Open Network Bridge VendorSiemens Affected 2019 R1 Fixed in — No fix listed CNA
- Siveillance Video Open Network Bridge VendorSiemens Affected 2018 R3 Fixed in — No fix listed CNA
- Siveillance Video Open Network Bridge VendorSiemens Affected 2018 R2 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r2:*:*:*:*:*:* | 2018 r2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r3:*:*:*:*:*:* | 2018 r3 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r1:*:*:*:*:*:* | 2019 r1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r2:*:*:*:*:*:* | 2019 r2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r3:*:*:*:*:*:* | 2019 r3 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r1:*:*:*:*:*:* | 2020 r1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r2:*:*:*:*:*:* | 2020 r2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r3:*:*:*:*:*:* | 2020 r3 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r2:*:*:*:*:*:* Versions 2018 r2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r3:*:*:*:*:*:* Versions 2018 r3 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r1:*:*:*:*:*:* Versions 2019 r1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r2:*:*:*:*:*:* Versions 2019 r2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r3:*:*:*:*:*:* Versions 2019 r3 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r1:*:*:*:*:*:* Versions 2020 r1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r2:*:*:*:*:*:* Versions 2020 r2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r3:*:*:*:*:*:* Versions 2020 r3 Vulnerable ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27392
- 2026-10-03 Alias added: GHSA-5346-4j79-hf8j
References
Sources
- CVE-2021-27392 · CVE Program
- CVE-2021-27392 · NVD
- FIRST EPSS
- GHSA-5346-4j79-hf8j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences