Vulnerability Details : CVE-2021-27392
A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server.
Products affected by CVE-2021-27392
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r2:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r3:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r1:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r2:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r3:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r1:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r2:*:*:*:*:*:*
- cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r3:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-27392
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-27392
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2021-27392
-
The product uses a hard-coded, unchangeable cryptographic key.Assigned by: productcert@siemens.com (Secondary)
-
The product contains hard-coded credentials, such as a password or cryptographic key.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-27392
-
https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf
Vendor Advisory
Jump to