Description
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Siemens Desigo CC
All versions with OIS Extension Moduleaffected
Siemens GMA-Manager
All versions with OIS running on Debian 9 or earlieraffected
Siemens Operation Scheduler
All versions with OIS running on Debian 9 or earlieraffected
Siemens Siveillance Control
All versions with OIS running on Debian 9 or earlieraffected
Siemens Siveillance Control Pro
All versionsaffected