CISA republishes Siemens advisory on Siveillance Video command injection flaw

CISA republished a Siemens advisory on Aug. 13 warning that Siemens Siveillance Video Management Servers are affected by a critical command injection vulnerability that could allow remote code execution.

The advisory identifies the flaw as CVE-2026-3014 and maps it to CWE-78, or improper neutralization of special elements used in an operating system command. CISA lists the issue as having a CVSS v3.1 base score of 9.1 and a severity rating of Critical.

The advisory says the affected versions are Siveillance Video V2023 R3 earlier than 23.3.27, V2024 R1 earlier than 24.1.16, and V2025 earlier than 25.1.15. Siemens recommends updating to V23.3 HotfixRev27 or later, V24.1 HotfixRev16 or later, and V25.1 HotfixRev15 or later.

CISA’s posting says the products are used in Critical Manufacturing, Communications and Commercial Facilities sectors, with deployments listed as worldwide and Siemens headquartered in Germany. The advisory also says Milestone PSIRT reported the vulnerability to Siemens.

CISA included general defensive guidance to limit network exposure for control system devices and systems, isolate control system networks and remote devices behind firewalls and away from business networks, and use VPNs for remote access when needed.

The source text does not report any confirmed exploitation, incidents or customer impact. CISA’s revision history shows an initial release date of Aug. 11 and a republication date of Aug. 13.

Sources

• CISA Cybersecurity Advisories

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.