CVE-2019-18342 - A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0)

Back Back to CVE browser

CRITICAL

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0)

Published Dec 12, 2019

9.9

CRITICAL

CVSS 3.1

EPSS 2.13%

Description

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server (CCS) does not properly limit its capabilities to the specified purpose.

In conjunction with CVE-2019-18341, an unauthenticated remote attacker with network access to the CCS server could exploit this vulnerability to read or delete arbitrary files, or access other resources on the same server.

Affected products

Vendor Siemens Product Control Center Server (CCS) Default
n/a
- Version
  All versions < V1.5.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Siemens

Control Center Server (CCS)

n/a

Version	Status	Constraints
All versions < V1.5.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-749

References (3)

https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf
x_refsource_MISCNot ApplicableVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf
x_refsource_CONFIRMVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8131
Advisory

Link	Providers	Tags
https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf		x_refsource_MISCNot ApplicableVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf		x_refsource_CONFIRMVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8131		Advisory