As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
- CVSS v4 5.2
- ATTENTION: Exploitable locally
- Vendor: Siemens
- Equipment: Siveillance Video Camera Drivers
- Vulnerability: Insertion of Sensitive Information into Log File
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow a local attacker to read camera credentials stored in the Recording Server under specific conditions.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the following products are affected:
- Siveillance Video Device Pack: Versions prior to V13.5
3.2 VULNERABILITY OVERVIEW
3.2.1 INSERTION OF SENSITIVE INFORMATION INTO LOG FILE CWE-532
Disclosure of sensitive information in HikVision camera driver’s log file in XProtect Device Pack allows an attacker to read camera credentials stored in the Recording Server under specific conditions.
CVE-2024-12569 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2024-12569. A base score of 5.2 has been calculated; the CVS
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: