CVE-2021-27392

{"containers": {"cna": {"affected": [{"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2020 R3"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2020 R2"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2020 R1"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2019 R3"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2019 R2"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2019 R1"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2018 R3"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2018 R2"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "description": "CWE-321: Use of Hard-coded Cryptographic Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-22T20:42:21.000Z", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-27392", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Siveillance Video Open Network Bridge", "version": {"version_data": [{"version_value": "2020 R3"}]}}, {"product_name": "Siveillance Video Open Network Bridge", "version": {"version_data": [{"version_value": "2020 R2"}]}}, {"product_name": "Siveillance Video Open Network Bridge", "version": {"version_data": [{"version_value": "2020 R1"}]}}, {"product_name": "Siveillance Video Open Network Bridge", "version": {"version_data": [{"version_value": "2019 R3"}]}}, {"product_name": "Siveillance Video Open Network Bridge", "version": {"version_data": [{"version_value": "2019 R2"}]}}, {"product_name": "Siveillance Video Open Network Bridge", "version": {"version_data": [{"version_value": "2019 R1"}]}}, {"product_name": "Siveillance Video Open Network Bridge", "version": {"version_data": [{"version_value": "2018 R3"}]}}, {"product_name": "Siveillance Video Open Network Bridge", "version": {"version_data": [{"version_value": "2018 R2"}]}}]}, "vendor_name": "Siemens"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-321: Use of Hard-coded Cryptographic Key"}]}]}, "references": {"reference_data": [{"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:48:16.928Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf"}]}]}, "cveMetadata": {"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2021-27392", "datePublished": "2021-04-22T20:42:21.000Z", "dateReserved": "2021-02-18T00:00:00.000Z", "dateUpdated": "2024-08-03T20:48:16.928Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2020 R3"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2020 R2"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2020 R1"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2019 R3"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2019 R2"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2019 R1"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2018 R3"}]}, {"product": "Siveillance Video Open Network Bridge", "vendor": "Siemens", "versions": [{"status": "affected", "version": "2018 R2"}]}], "source": "productcert@siemens.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r2:*:*:*:*:*:*", "matchCriteriaId": "AC2636FC-7417-44A5-871C-EAABC66C3938", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r3:*:*:*:*:*:*", "matchCriteriaId": "49CB17B2-6591-41B4-8A21-A75E91B6191C", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r1:*:*:*:*:*:*", "matchCriteriaId": "23505544-DAC7-4C1F-97E4-02E13E1E3C41", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r2:*:*:*:*:*:*", "matchCriteriaId": "D4A23006-E5B5-4164-9230-1E4DEF33577E", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r3:*:*:*:*:*:*", "matchCriteriaId": "9519AB27-BAF0-4837-B4E8-56814D00BB8D", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r1:*:*:*:*:*:*", "matchCriteriaId": "FEBEEC11-F400-46F5-B285-1247735F97EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r2:*:*:*:*:*:*", "matchCriteriaId": "C80F5250-CBA7-40DB-BFB6-B74007715EE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r3:*:*:*:*:*:*", "matchCriteriaId": "F53DC222-1181-4573-9ED1-9750D35E65A7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Los puentes de red abiertos afectados almacenan las credenciales de usuario para la autenticaci\u00f3n entre los clientes ONVIF y el servidor ONVIF usando una clave embebida. Las credenciales cifradas pueden ser recuperadas por medio del MIP SDK. Esto podr\u00eda permitir a un atacante remoto autenticado recuperar y descifrar todas las credenciales almacenadas en el servidor ONVIF"}], "id": "CVE-2021-27392", "lastModified": "2026-06-17T03:44:46.507", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-22T21:15:10.363", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "productcert@siemens.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}