Siveillance Control Pro V3 0
Monthly
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.