SSA-254516

Siemens Security Advisory by Siemens ProductCERT

SSA-254516: Arbitrary File Upload in OIS Web Module

Publication Date:	2026-09-08
Last Update:	2026-09-08
Current Version:	V1.0
CVSS v3.1 Base Score:	9.0
CVSS v4.0 Base Score:	8.9

SUMMARY

A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . This vulnerability allows an attacker to upload arbitrary files, which can lead to unauthorized root-level access on the OIS server.

Siemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
Siveillance Control	Show more details
Siveillance Control V3.0 All versions < V3.0.22.2177 affected by CVE-2026-50093	Update to V3.0.22.2177 or later version https://support.industry.siemens.com/cs/ww/en/view/110004859/
Siveillance Control V4.0 All versions < V4.0.11.2177 affected by CVE-2026-50093	Update to V4.0.11.2177 or later version https://support.industry.siemens.com/cs/ww/en/view/110004859/
Siveillance Control Pro	Show more details
Siveillance Control Pro V3.0 All versions < V3.0.12.2173 affected by CVE-2026-50093	Update to V3.0.12.2173 or later version https://support.industry.siemens.com/cs/ww/en/view/110004860/
Siveillance Control Pro V4.0 All versions < V4.0.9.2178 affected by CVE-2026-50093	Update to V4.0.9.2178 or later version https://support.industry.siemens.com/cs/ww/en/view/110004860/

MITIGATIONS

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.

PRODUCT DESCRIPTION

Siveillance Control Pro is a command and control solution, specifically designed to support security management at critical infrastructure sites such as ports, airports, oil and gas power generation and distribution, chemical and pharma industries, heavy industries and campus environments.

Siveillance Control, formerly known as Siveillance Viewpoint, is a Physical Security Information Management system (PSIM) that seamlessly consolidates a variety of safety and security systems, such as access control, intrusion detection, and video surveillance, all on one common platform.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2026-50093

A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this vulnerability could allow an attacker to gain root access on the host system, potentially leading to a full compromise of the affected OIS environment.

CVSS v3.1 Base Score	9.0
CVSS v3.1 Vector	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0 Base Score	8.9
CVSS v4.0 Vector	CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE	CWE-434: Unrestricted Upload of File with Dangerous Type

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-09-08):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.