Deserialization of untrusted data in Siemens Siveillance Video 2020 R2
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Event Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Siveillance Video 2020 R2 | All versions < V20.2 HotfixRev14 | — | No fix listed | CNA |
| Siemens | Siveillance Video 2020 R3 | All versions < V20.3 HotfixRev12 | — | No fix listed | CNA |
| Siemens | Siveillance Video 2021 R1 | All versions < V21.1 HotfixRev12 | — | No fix listed | CNA |
| Siemens | Siveillance Video 2021 R2 | All versions < V21.2 HotfixRev8 | — | No fix listed | CNA |
| Siemens | Siveillance Video 2022 R1 | All versions < V22.1 HotfixRev7 | — | No fix listed | CNA |
| Siemens | Siveillance Video 2022 R2 | All versions < V22.2 HotfixRev5 | — | No fix listed | CNA |
| Siemens | Siveillance Video 2022 R3 | All versions < V22.3 HotfixRev2 | — | No fix listed | CNA |
| Siemens | Siveillance Video 2023 R1 | All versions < V23.1 HotfixRev1 | — | No fix listed | CNA |
- Siveillance Video 2020 R2 VendorSiemens Affected All versions < V20.2 HotfixRev14 Fixed in — No fix listed CNA
- Siveillance Video 2020 R3 VendorSiemens Affected All versions < V20.3 HotfixRev12 Fixed in — No fix listed CNA
- Siveillance Video 2021 R1 VendorSiemens Affected All versions < V21.1 HotfixRev12 Fixed in — No fix listed CNA
- Siveillance Video 2021 R2 VendorSiemens Affected All versions < V21.2 HotfixRev8 Fixed in — No fix listed CNA
- Siveillance Video 2022 R1 VendorSiemens Affected All versions < V22.1 HotfixRev7 Fixed in — No fix listed CNA
- Siveillance Video 2022 R2 VendorSiemens Affected All versions < V22.2 HotfixRev5 Fixed in — No fix listed CNA
- Siveillance Video 2022 R3 VendorSiemens Affected All versions < V22.3 HotfixRev2 Fixed in — No fix listed CNA
- Siveillance Video 2023 R1 VendorSiemens Affected All versions < V23.1 HotfixRev1 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:siveillance_video:2020:r2:*:*:*:*:*:* | 2020 r2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video:2020:r3:*:*:*:*:*:* | 2020 r3 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video:2021:r1:*:*:*:*:*:* | 2021 r1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video:2021:r2:*:*:*:*:*:* | 2021 r2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video:2022:r1:*:*:*:*:*:* | 2022 r1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video:2022:r2:*:*:*:*:*:* | 2022 r2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video:2022:r3:*:*:*:*:*:* | 2022 r3 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video:2023:r1:*:*:*:*:*:* | 2023 r1 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:siveillance_video:2020:r2:*:*:*:*:*:* Versions 2020 r2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video:2020:r3:*:*:*:*:*:* Versions 2020 r3 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video:2021:r1:*:*:*:*:*:* Versions 2021 r1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video:2021:r2:*:*:*:*:*:* Versions 2021 r2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video:2022:r1:*:*:*:*:*:* Versions 2022 r1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video:2022:r2:*:*:*:*:*:* Versions 2022 r2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video:2022:r3:*:*:*:*:*:* Versions 2022 r3 Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video:2023:r1:*:*:*:*:*:* Versions 2023 r1 Vulnerable ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-30898
- 2026-10-03 Alias added: GHSA-54q6-cwpf-m2c8
References
More Siemens Siveillance Video vulnerabilities
- TI-2023-14658 Deserialization of untrusted data in Siemens Siveillance Video 2020 R2 CVSS 3.1CRITICAL 9.9
Sources
- CVE-2023-30898 · CVE Program
- CVE-2023-30898 · NVD
- FIRST EPSS
- GHSA-54q6-cwpf-m2c8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences