Vulnerability · Published May 9, 2023 · Assigned by siemens
CVE-2023-30899
Critical 9.9
In plain English
A critical-severity unsafe deserialization in Siveillance Video 2020 R2 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Siveillance Video 2020 R2 | All versions < V20.2 HotfixRev14 |
| Siemens | Siveillance Video 2020 R3 | All versions < V20.3 HotfixRev12 |
| Siemens | Siveillance Video 2021 R1 | All versions < V21.1 HotfixRev12 |
| Siemens | Siveillance Video 2021 R2 | All versions < V21.2 HotfixRev8 |
| Siemens | Siveillance Video 2022 R1 | All versions < V22.1 HotfixRev7 |
| Siemens | Siveillance Video 2022 R2 | All versions < V22.2 HotfixRev5 |
| Siemens | Siveillance Video 2022 R3 | All versions < V22.3 HotfixRev2 |
| Siemens | Siveillance Video 2023 R1 | All versions < V23.1 HotfixRev1 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C