CVE-2021-27392
Estado: ModificadaAlta (8.8)—
A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.18%
- Percentil entre todas las CVEs puntuadas: 67
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-321
- CWE-798
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-27392",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "productcert@siemens.com",
"affectedData": [
{
"vendor": "Siemens",
"product": "Siveillance Video Open Network Bridge",
"versions": [
{
"status": "affected",
"version": "2020 R3"
}
]
},
{
"vendor": "Siemens",
"product": "Siveillance Video Open Network Bridge",
"versions": [
{
"status": "affected",
"version": "2020 R2"
}
]
},
{
"vendor": "Siemens",
"product": "Siveillance Video Open Network Bridge",
"versions": [
{
"status": "affected",
"version": "2020 R1"
}
]
},
{
"vendor": "Siemens",
"product": "Siveillance Video Open Network Bridge",
"versions": [
{
"status": "affected",
"version": "2019 R3"
}
]
},
{
"vendor": "Siemens",
"product": "Siveillance Video Open Network Bridge",
"versions": [
{
"status": "affected",
"version": "2019 R2"
}
]
},
{
"vendor": "Siemens",
"product": "Siveillance Video Open Network Bridge",
"versions": [
{
"status": "affected",
"version": "2019 R1"
}
]
},
{
"vendor": "Siemens",
"product": "Siveillance Video Open Network Bridge",
"versions": [
{
"status": "affected",
"version": "2018 R3"
}
]
},
{
"vendor": "Siemens",
"product": "Siveillance Video Open Network Bridge",
"versions": [
{
"status": "affected",
"version": "2018 R2"
}
]
}
]
}
],
"published": "2021-04-22T21:15:10.363",
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf",
"tags": [
"Vendor Advisory"
],
"source": "productcert@siemens.com"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "productcert@siemens.com",
"description": [
{
"lang": "en",
"value": "CWE-321"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-798"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server."
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad en Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Los puentes de red abiertos afectados almacenan las credenciales de usuario para la autenticación entre los clientes ONVIF y el servidor ONVIF usando una clave embebida. Las credenciales cifradas pueden ser recuperadas por medio del MIP SDK. Esto podría permitir a un atacante remoto autenticado recuperar y descifrar todas las credenciales almacenadas en el servidor ONVIF"
}
],
"lastModified": "2026-06-17T03:44:46.507",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC2636FC-7417-44A5-871C-EAABC66C3938"
},
{
"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49CB17B2-6591-41B4-8A21-A75E91B6191C"
},
{
"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "23505544-DAC7-4C1F-97E4-02E13E1E3C41"
},
{
"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D4A23006-E5B5-4164-9230-1E4DEF33577E"
},
{
"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9519AB27-BAF0-4837-B4E8-56814D00BB8D"
},
{
"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FEBEEC11-F400-46F5-B285-1247735F97EF"
},
{
"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C80F5250-CBA7-40DB-BFB6-B74007715EE2"
},
{
"criteria": "cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F53DC222-1181-4573-9ED1-9750D35E65A7"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "productcert@siemens.com"
}