Read the docs
TI-2021-20123 Aliases CVE-2021-44523GHSA-wf58-48gj-3f44

Exposure of resource to wrong sphere in Siemens SiPass integrated V2.76

Priority MEDIUM 42CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal activity feed database. This could allow an unauthenticated remote attacker to read, modify or delete activity feed entries.

Why it matters now

EPSS 0.01405 72nd percentileScored 2026-11-07
Fix Fixed Siveillance Identity V1.6 (Siemens): V1.6.284.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSiPass integrated V2.76All versions—No fix listedCNA
SiemensSiPass integrated V2.80All versions—No fix listedCNA
SiemensSiPass integrated V2.85All versions—No fix listedCNA
SiemensSiveillance Identity V1.5All versions—No fix listedCNA
SiemensSiveillance Identity V1.6before V1.6.284.0V1.6.284.0Patch availableCNA
  • SiPass integrated V2.76 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SiPass integrated V2.80 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SiPass integrated V2.85 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Siveillance Identity V1.5 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Siveillance Identity V1.6 VendorSiemens Affected before V1.6.284.0 Fixed in V1.6.284.0 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:siemens:sipass_integrated:2.76:-:*:*:*:*:*:*2.76VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.76:sp1:*:*:*:*:*:*2.76 sp1VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*2.80VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*2.85VulnerableSiemens
cpe:2.3:a:siemens:siveillance_identity:*:*:*:*:*:*:*:*1.6 – 1.6.280.0VulnerableSiemens
cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*1.5VulnerableSiemens
  • cpe:2.3:a:siemens:sipass_integrated:2.76:-:*:*:*:*:*:* Versions 2.76 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.76:sp1:*:*:*:*:*:* Versions 2.76 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* Versions 2.80 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* Versions 2.85 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_identity:*:*:*:*:*:*:*:* Versions 1.6 – 1.6.280.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Siemens

Remediation

  • Fix · CNA Siveillance Identity V1.6 (Siemens) Fixed in V1.6.284.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44523
  2. 2026-10-03 Alias added: GHSA-wf58-48gj-3f44

References

Advisory 2

  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
  • TI-2012-04567 AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not… CVSS 2.0HIGH 10.0
  • TI-2017-07307 Improper authentication in SiPass integrated All versions before V2.70 CVSS 3.0CRITICAL 9.8
  • TI-2022-13702 Out-of-bounds read in Siemens SiPass integrated CVSS 4.0HIGH 8.7
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences