Sign-up

ID

VAR-201503-0021


CVE

CVE-2015-1599


TITLE

SPCanywhere Authentication Bypass Vulnerability

Trust: 0.8

sources: IVD: 9e5c667e-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-01536

DESCRIPTION

The Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass intended access restrictions by leveraging a filesystem architectural error. SPCanywhere is a mobile app. The Siemens SPC intrusion alarm system can be accessed remotely via a mobile phone. SPCanywhere has an authentication bypass vulnerability that allows an attacker to bypass certain security restrictions and perform unauthorized operations. Siemens SPCanywhere is prone to an authentication-bypass vulnerability. A security vulnerability exists in the Siemens SPCanywhere application based on the iOS platform

Trust: 2.7

sources: NVD: CVE-2015-1599 // JVNDB: JVNDB-2015-001708 // CNVD: CNVD-2015-01536 // BID: 72971 // IVD: 9e5c667e-2351-11e6-abef-000c29c66e3d // VULHUB: VHN-79560

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 9e5c667e-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-01536

AFFECTED PRODUCTS

vendor:siemensmodel:spcanywherescope:lteversion:1.4

Trust: 1.0

vendor:siemensmodel:spcanywherescope:eqversion:(ios)

Trust: 0.8

vendor:siemensmodel:spcanywhere <=1.49scope: - version: -

Trust: 0.6

vendor:siemensmodel:spcanywherescope:eqversion:1.4

Trust: 0.6

vendor:siemensmodel:spcanywherescope:eqversion:0

Trust: 0.3

vendor:spcanywheremodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 9e5c667e-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-01536 // BID: 72971 // JVNDB: JVNDB-2015-001708 // CNNVD: CNNVD-201503-133 // NVD: CVE-2015-1599

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-1599
value: LOW

Trust: 1.0

NVD: CVE-2015-1599
value: LOW

Trust: 0.8

CNVD: CNVD-2015-01536
value: LOW

Trust: 0.6

CNNVD: CNNVD-201503-133
value: LOW

Trust: 0.6

IVD: 9e5c667e-2351-11e6-abef-000c29c66e3d
value: LOW

Trust: 0.2

VULHUB: VHN-79560
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2015-1599
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-01536
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 9e5c667e-2351-11e6-abef-000c29c66e3d
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-79560
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 9e5c667e-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-01536 // VULHUB: VHN-79560 // JVNDB: JVNDB-2015-001708 // CNNVD: CNNVD-201503-133 // NVD: CVE-2015-1599

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-79560 // JVNDB: JVNDB-2015-001708 // NVD: CVE-2015-1599

THREAT TYPE

local

Trust: 0.9

sources: BID: 72971 // CNNVD: CNNVD-201503-133

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201503-133

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-001708

PATCH
title:SSA-185226url:http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
Trust: 0.8
title:SPCanywhere authentication bypass vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/56033
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-01536 // 
            
            
            
            JVNDB: JVNDB-2015-001708

EXTERNAL IDS
db:NVDid:CVE-2015-1599
Trust: 3.6
db:SIEMENSid:SSA-185226
Trust: 2.0
db:BIDid:72971
Trust: 1.0
db:CNNVDid:CNNVD-201503-133
Trust: 0.9
db:CNVDid:CNVD-2015-01536
Trust: 0.8
db:JVNDBid:JVNDB-2015-001708
Trust: 0.8
db:ICS CERTid:ICSA-15-064-05
Trust: 0.3
db:IVDid:9E5C667E-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-79560
Trust: 0.1
sources:
            
            
            IVD: 9e5c667e-2351-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2015-01536 // 
            
            
            
            VULHUB: VHN-79560 // 
            
            
            
            BID: 72971 // 
            
            
            
            JVNDB: JVNDB-2015-001708 // 
            
            
            
            CNNVD: CNNVD-201503-133 // 
            
            
            
            NVD: CVE-2015-1599

REFERENCES
url:http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
Trust: 2.0
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-1599
Trust: 1.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1599
Trust: 0.8
url:http://subscriber.communications.siemens.com/
Trust: 0.3
url:https://ics-cert.us-cert.gov/advisories/icsa-15-064-05
Trust: 0.3
url:http://www.spc-intruder-detection.com/ssp-spc/spc_mobileapp.php
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2015-01536 // 
            
            
            
            VULHUB: VHN-79560 // 
            
            
            
            BID: 72971 // 
            
            
            
            JVNDB: JVNDB-2015-001708 // 
            
            
            
            CNNVD: CNNVD-201503-133 // 
            
            
            
            NVD: CVE-2015-1599

CREDITS
Kim Schlyter, Seyton Bradford and Richard Warren from FortConsult .
Trust: 0.3
sources:
            
            
            BID: 72971

SOURCES
db:IVDid:9e5c667e-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2015-01536
db:VULHUBid:VHN-79560
db:BIDid:72971
db:JVNDBid:JVNDB-2015-001708
db:CNNVDid:CNNVD-201503-133
db:NVDid:CVE-2015-1599

LAST UPDATE DATE
2025-04-12T22:59:39.989000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-01536date:2015-03-11T00:00:00
db:VULHUBid:VHN-79560date:2015-03-09T00:00:00
db:BIDid:72971date:2015-03-05T00:00:00
db:JVNDBid:JVNDB-2015-001708date:2015-03-11T00:00:00
db:CNNVDid:CNNVD-201503-133date:2015-03-11T00:00:00
db:NVDid:CVE-2015-1599date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:IVDid:9e5c667e-2351-11e6-abef-000c29c66e3ddate:2015-03-11T00:00:00
db:CNVDid:CNVD-2015-01536date:2015-03-11T00:00:00
db:VULHUBid:VHN-79560date:2015-03-07T00:00:00
db:BIDid:72971date:2015-03-05T00:00:00
db:JVNDBid:JVNDB-2015-001708date:2015-03-11T00:00:00
db:CNNVDid:CNNVD-201503-133date:2015-03-09T00:00:00
db:NVDid:CVE-2015-1599date:2015-03-07T02:59:08.397