CVE-2022-43400: critical vulnerability in Siemens Siveillance Video Mobile Server V2022 R2
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in Siveillance Video Mobile Server allows attackers to log in without valid credentials by exploiting how the system handles Active Directory administrator accounts. This could let anyone access the application remotely without authorization.
The vulnerability exists in the authentication mechanism for Active Directory accounts assigned to the Administrators group; an unauthenticated remote attacker can bypass login requirements through improper handling of these privileged accounts. The attack requires network access to the mobile server but no prior credentials, resulting in complete unauthorized access to the application.