Full Report
The latest update for the Siveillance VMS Video mobile app for Android and iOS fixes a security vulnerability that could allow an attacker in a privileged network position to read data from and write data to the encrypted communication channel between the app and a server. Precondition for this scenario is that an attacker is able to intercept the communication channel between the affected app and a server, and is also able to generate a certificate that results for the validation algorithm in a checksum identical to a trusted certificate.
Analysis Summary
# Vulnerability: Weak Certificate Validation in Siveillance VMS Video Mobile App
## CVE Details
- **CVE ID:** CVE-2023-36365 (Note: Based on Siemens advisory SSA-582540)
- **CVSS Score:** 6.8 (Medium)
- **CWE:** CWE-295: Improper Certificate Validation / CWE-354: Improper Validation of Integrity Check Value
## Affected Systems
- **Products:** Siemens Siveillance VMS Video Mobile App
- **Versions:**
- Android: All versions prior to v23.1
- iOS: All versions prior to v23.1
- **Configurations:** Systems where the mobile app communicates with a Siveillance VMS server over an encrypted channel.
## Vulnerability Description
The vulnerability exists due to an improper certificate validation algorithm within the mobile application. The app relies on a checksum-based validation for certificates rather than full cryptographic chain-of-trust verification. An attacker who can generate a malicious certificate resulting in a checksum identical to a trusted certificate (a hash collision) can bypass the encryption protections. This allows the attacker to perform a Man-in-the-Middle (MitM) attack.
## Exploitation
- **Status:** Not exploited (No known public exploits at this time)
- **Complexity:** High (Requires the ability to intercept network traffic and generate a certificate with a specific matching checksum).
- **Attack Vector:** Network (Adjacent/Privileged network position).
## Impact
- **Confidentiality:** High (Attacker can read sensitive data from the encrypted communication channel).
- **Integrity:** High (Attacker can write/modify data within the communication channel).
- **Availability:** Low (Primary impact is on data privacy and integrity).
## Remediation
### Patches
- **Android:** Update to **v23.1** or later via the Google Play Store.
- **iOS:** Update to **v23.1** or later via the Apple App Store.
### Workarounds
- Ensure the mobile device is connected only to trusted, secure networks (e.g., corporate VPN) to prevent traffic interception.
- Avoid using public Wi-Fi or untrusted networks while using the app.
## Detection
- **Indicators of compromise:** Presence of unauthorized or suspicious certificates in the device's trust store (though difficult to detect if a collision is successful).
- **Detection methods and tools:** Network traffic analysis for unexpected interceptions; auditing app versions across the mobile fleet using MDM (Mobile Device Management) solutions.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-582540[.]pdf
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2023-36365