Siemens Siveillance Control
Siemens Siveillance Control OIS flaw lets low-privilege attackers upload files and gain root.
CISA republished Siemens SSA-254516 for CVE-2026-50093, an unrestricted file-upload flaw in the Open Interface Services web module used by Siveillance Control and Control Pro. A low-privileged attacker on an adjacent network can upload arbitrary files and obtain root on the OIS server. CVSS 3.1 is 9.0. Fixed builds start at Control Pro 3.0.12.2173 and 4.0.9.2178, and Control 3.0.22.2177 and 4.0.11.2177. Siemens has released patches; exploitation is not reported.
- CVE-2026-50093 is unrestricted file upload with CVSS 9.0.
- Adjacent-network attackers with low privileges can gain root on OIS.
- Siveillance Control and Control Pro V3 and V4 need the listed updates.
- Sectors include critical manufacturing, communications, and commercial facilities.
- CVEs
- CVE-2026-50093
- Vendors
- Siemens
- Organizations
- CISASiemens ProductCERT
- Countries
- Germany
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50093 | Arbitrary File Upload in Siemens Siveillance Control OIS Web Module Leads to Root Access | 8.9 | <1% |
From the original article
3 min read at cisa.govView CSAF Summary A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3. x. y and OIS 4.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.