CVE-2020-15785 Information disclosure in Siveillance Video Client
An attacker in a privileged network position can capture cleartext usernames from Siveillance Video Client when NTLM authentication is enabled, facilitating further attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15785?
CVE-2020-15785 is a medium-severity vulnerability in Siemens AG Siveillance Video Client, published on 9 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in Siveillance Video Client (All versions). In environments where Windows NTLM authentication is enabled the affected client application transmits usernames to the server in cleartext. This could allow an attacker in a privileged network position to obtain valid adminstrator login names and use this information to launch further attacks.
Weakness: CWE-319
Which versions are affected by CVE-2020-15785?
It affects 1 product.
Products include Siemens Siveillance Video Client.
How do I fix CVE-2020-15785?
No fix has been published for CVE-2020-15785 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-15785 being exploited?
There is no known exploitation of CVE-2020-15785 in the wild and no public exploit code.
Sources
Also known as GHSA-mp5j-ppmx-jxv4.