A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Desigo CC
Vendor
Siemens
Product
Desigo CC
Platforms
Unknown
Default status
Unknown
Desigo CC · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions with OIS Extension Module
affected
Unavailable
Unavailable
Unavailable
None listed
GMA-Manager
Vendor
Siemens
Product
GMA-Manager
Platforms
Unknown
Default status
Unknown
GMA-Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions with OIS running on Debian 9 or earlier
affected
Unavailable
Unavailable
Unavailable
None listed
Operation Scheduler
Vendor
Siemens
Product
Operation Scheduler
Platforms
Unknown
Default status
Unknown
Operation Scheduler · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions with OIS running on Debian 9 or earlier
affected
Unavailable
Unavailable
Unavailable
None listed
Siveillance Control
Vendor
Siemens
Product
Siveillance Control
Platforms
Unknown
Default status
Unknown
Siveillance Control · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions with OIS running on Debian 9 or earlier
affected
Unavailable
Unavailable
Unavailable
None listed
Siveillance Control Pro
Vendor
Siemens
Product
Siveillance Control Pro
Platforms
Unknown
Default status
Unknown
Siveillance Control Pro · Scoped product and version facts