CVE-2021-44524

CRITICAL

Siemens Sipass Integrated < 1.6.284.0 - Exposure to Wrong Actor

Title source: rule

Description

A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote attacker to trigger several actions on behalf of valid user accounts.

References (2)

[Vendor Advisory] https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf

[Vendor Advisory] https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf

Scores

CVSS v3 9.8

EPSS 0.0058

EPSS Percentile 68.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-287 CWE-668

Status published

Affected Products (6)

siemens/sipass_integrated

siemens/siveillance_identity < 1.6.284.0

siemens/siveillance_identity

Timeline

Published Dec 14, 2021

Tracked Since Feb 18, 2026