Siemens Siveillance VMS (Update A)
The Recording Server, Management Server, and Management Client on ports 6473/TCP local connection only, 7474/TCP, 8966/TCP local connection only, and port 9993/TCP use an exploitable .NET Framework Remoting deserialization level. The security vulnerability could be exploited by an attacker with access to the vulnerable ports and could allow elevation of privileges or causing a Denial-of-Service, compromising confidentiality, integrity and availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.