ICS Advisory: Siemens Siveillance Control

Here is a summary of the document:

Summary:

As of January 10, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. The advisory reports a vulnerability in Siemens' Siveillance Control product, which allows a locally logged-on user to gain write privileges for objects where they only have read privileges. The vulnerability has been assigned CVE-2023-45793 and has a CVSS v4 score of 6.8. The affected product versions are V2.8 and after until V3.1.1. The advisory provides mitigation recommendations, including updating to a newer version and restricting access to the machine where the Siveillance Control frontend is installed.