CVE-2021-27392
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
72.5%
A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server.
Affected configurations
CNA Affected
[
{
"product": "Siveillance Video Open Network Bridge",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "2020 R3"
}
]
},
{
"product": "Siveillance Video Open Network Bridge",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "2020 R2"
}
]
},
{
"product": "Siveillance Video Open Network Bridge",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "2020 R1"
}
]
},
{
"product": "Siveillance Video Open Network Bridge",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "2019 R3"
}
]
},
{
"product": "Siveillance Video Open Network Bridge",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "2019 R2"
}
]
},
{
"product": "Siveillance Video Open Network Bridge",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "2019 R1"
}
]
},
{
"product": "Siveillance Video Open Network Bridge",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "2018 R3"
}
]
},
{
"product": "Siveillance Video Open Network Bridge",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "2018 R2"
}
]
}
]Related
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
72.5%