{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "The mobile server component of Siveillance Video 2022 R2 contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to access the application without a valid account.\n\nSiemens has released a hotfix for Siveillance Video 2022 R2 and recommends to apply the hotfix on all installations of the mobile server.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-640732: Authentication Bypass Vulnerability in Siveillance Video Mobile Server - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-640732.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-640732: Authentication Bypass Vulnerability in Siveillance Video Mobile Server - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-640732.txt"
      },
      {
        "category": "self",
        "summary": "SSA-640732: Authentication Bypass Vulnerability in Siveillance Video Mobile Server - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-640732.json"
      }
    ],
    "title": "SSA-640732: Authentication Bypass Vulnerability in Siveillance Video Mobile Server",
    "tracking": {
      "current_release_date": "2022-10-21T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-640732",
      "initial_release_date": "2022-10-21T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-10-21T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V22.2a (80)",
                "product": {
                  "name": "Siveillance Video Mobile Server V2022 R2",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Video Mobile Server V2022 R2"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-43400",
      "cwe": {
        "id": "CWE-1390",
        "name": "Weak Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The mobile server component of affected applications improperly handles the log in for Active Directory accounts that are part of Administrators group.\r\n\r\nThis could allow an unauthenticated remote attacker to access the application without a valid account.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Enable the feature \n\"Servers \u0026gt; Mobile Servers \u0026gt; Deny the built-in Administrators role access to the mobile servers\" for all configured mobile servers",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V22.2a (80) or later version by applying the latest hotfix of the Mobile Server Installer (Vulnerability Hotfix)",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812608/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-43400"
    }
  ]
}