Full Report
Siveillance Video is affected by a security bypass vulnerability in the Microsoft .NET implementation of SQL Client as described in CVE-2024-0056. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Security Bypass in SQL Client Communication for Siveillance Video
## CVE Details
- **CVE ID:** CVE-2024-0056
- **CVSS Score:** 8.7 (High)
- **CWE:** CWE-319: Cleartext Transmission of Sensitive Information
## Affected Systems
- **Products:** Siemens Siveillance Video (formerly Siveillance VMS) - Core, Core Plus, Advanced, and Pro.
- **Versions:**
- Siveillance Video 2022 R1: All versions < V22.1 HotfixRev16
- Siveillance Video 2022 R2: All versions < V22.2 HotfixRev16
- Siveillance Video 2022 R3: All versions < V22.3 HotfixRev15
- Siveillance Video 2023 R1: All versions < V23.1 HotfixRev14
- Siveillance Video 2023 R2: All versions < V23.2 HotfixRev13
- Siveillance Video 2023 R3: All versions < V23.3 HotfixRev11
- **Configurations:** Systems utilizing Microsoft.Data.SqlClient or System.Data.SqlClient for SQL Server communication.
## Vulnerability Description
This is a security feature bypass vulnerability existing in the Microsoft .NET implementation of the SQL Client. The flaw resides in how the client handles encrypted communication or certificate validation, potentially allowing for the cleartext transmission of sensitive information. In the context of Siveillance Video, this affects the secure communication channel between the application and its backend SQL database.
## Exploitation
- **Status:** Not explicitly reported as exploited in the wild in the advisory; however, it is a known Microsoft .NET vulnerability.
- **Complexity:** High (Requires specific timing/positioning to intercept or bypass the security features).
- **Attack Vector:** Network (Applicable to the communication path between the application server and the database).
## Impact
- **Confidentiality:** High (Potential exposure of database credentials or sensitive video metadata).
- **Integrity:** High (Potential for Man-in-the-Middle attacks to alter data in transit).
- **Availability:** None reported.
## Remediation
### Patches
Siemens recommends updating to the following versions or later:
- **2022 R1:** V22.1 HotfixRev16
- **2022 R2:** V22.2 HotfixRev16
- **2022 R3:** V22.3 HotfixRev15
- **2023 R1:** V23.1 HotfixRev14
- **2023 R2:** V23.2 HotfixRev13
- **2023 R3:** V23.3 HotfixRev11
### Workarounds
No specific software workarounds are provided. Siemens recommends:
- Protecting network access to affected products via firewalls and network segmentation.
- Running the software strictly within a protected IT environment following industry-standard security practices.
## Detection
- **Indicators of Compromise:** Unusual network traffic between the Siveillance Video server and the SQL database, specifically unencrypted SQL traffic where encryption is expected.
- **Detection Methods:** Network monitoring tools capable of inspecting TLS/SSL handshakes or identifying downgraded SQL connections.
## References
- **Siemens Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-472448[.]pdf
- **Microsoft CVE:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2024-0056
- **Siemens Support Links (Defanged):**
- hxxps[://]support[.]industry[.]siemens[.]com/cs/ww/en/view/109810201/
- hxxps[://]support[.]industry[.]siemens[.]com/cs/ww/en/view/109827783/