Read the docs
TI-2021-20124 Aliases CVE-2021-44524GHSA-7m98-whf4-6699

Exposure of resource to wrong sphere in Siemens SiPass integrated V2.76

Priority MEDIUM 45CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote attacker to trigger several actions on behalf of valid user accounts.

Why it matters now

EPSS 0.01632 76th percentileScored 2026-11-07
Fix Fixed Siveillance Identity V1.6 (Siemens): V1.6.284.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSiPass integrated V2.76All versions—No fix listedCNA
SiemensSiPass integrated V2.80All versions—No fix listedCNA
SiemensSiPass integrated V2.85All versions—No fix listedCNA
SiemensSiveillance Identity V1.5All versions—No fix listedCNA
SiemensSiveillance Identity V1.6before V1.6.284.0V1.6.284.0Patch availableCNA
  • SiPass integrated V2.76 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SiPass integrated V2.80 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SiPass integrated V2.85 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Siveillance Identity V1.5 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Siveillance Identity V1.6 VendorSiemens Affected before V1.6.284.0 Fixed in V1.6.284.0 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:siemens:sipass_integrated:2.76:-:*:*:*:*:*:*2.76VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.76:sp1:*:*:*:*:*:*2.76 sp1VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*2.80VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*2.85VulnerableSiemens
cpe:2.3:a:siemens:siveillance_identity:*:*:*:*:*:*:*:*1.6 – 1.6.284.0VulnerableSiemens
cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*1.5VulnerableSiemens
  • cpe:2.3:a:siemens:sipass_integrated:2.76:-:*:*:*:*:*:* Versions 2.76 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.76:sp1:*:*:*:*:*:* Versions 2.76 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* Versions 2.80 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* Versions 2.85 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_identity:*:*:*:*:*:*:*:* Versions 1.6 – 1.6.284.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Siemens

Remediation

  • Fix · CNA Siveillance Identity V1.6 (Siemens) Fixed in V1.6.284.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44524
  2. 2026-10-03 Alias added: GHSA-7m98-whf4-6699

References

Advisory 2

  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
  • TI-2012-04567 AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not… CVSS 2.0HIGH 10.0
  • TI-2017-07307 Improper authentication in SiPass integrated All versions before V2.70 CVSS 3.0CRITICAL 9.8
  • TI-2022-13702 Out-of-bounds read in Siemens SiPass integrated CVSS 4.0HIGH 8.7
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences