CVE-2026-50093: Siveillance Control RCE Vulnerability

CVE-2026-50093 Overview

CVE-2026-50093 is an arbitrary file upload vulnerability in the Operator Information System (OIS) web module of Siemens Siveillance Control and Siveillance Control Pro. The flaw lets an authenticated attacker on an adjacent network upload arbitrary files to the server. Successful exploitation can grant root access on the host and lead to full compromise of the affected OIS environment. The weakness is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
An attacker with low privileges on an adjacent network can achieve root-level code execution on affected Siveillance Control servers, compromising confidentiality, integrity, and availability of the physical security management platform.

Affected Products

Siveillance Control Pro V3.0 — all versions prior to V3.0.12.2173
Siveillance Control Pro V4.0 — all versions prior to V4.0.9.2178
Siveillance Control V3.0 — all versions prior to V3.0.22.2177; Siveillance Control V4.0 — all versions prior to V4.0.11.2177

Discovery Timeline

2026-09-08 - CVE-2026-50093 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-50093

Vulnerability Analysis

The vulnerability resides in the OIS web module bundled with Siveillance Control and Siveillance Control Pro. The module accepts file uploads without adequately validating the file type, extension, or content. An attacker with valid low-privilege credentials on an adjacent network segment can upload executable content that the server subsequently processes. Because the OIS service runs with elevated permissions, code executed through the uploaded file inherits root-level privileges on the host operating system. Impact extends beyond the initial component: the subsequent system scope is also affected, meaning compromise of the OIS server can propagate to connected physical security infrastructure.

Root Cause

The underlying defect is unrestricted file upload, tracked as [CWE-434]. The OIS web module lacks strict allow-listing of file types, server-side content inspection, and safe storage of uploaded artifacts outside web-executable paths. This design gap allows an authenticated attacker to place a payload the server will execute or interpret.

Attack Vector

Exploitation requires network adjacency and low-privileged authentication. An attacker who reaches the OIS web interface authenticates, submits a malicious file through the vulnerable upload endpoint, and then triggers execution of the uploaded artifact. No user interaction is required to complete the attack chain. Because the resulting process runs as root, the attacker gains complete control of the underlying host and any data or connected systems the OIS server can reach.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication. See the Siemens Security Advisory SSA-254516 for vendor-supplied technical details.

Detection Methods for CVE-2026-50093

Indicators of Compromise

Unexpected files with executable extensions (.php, .jsp, .aspx, .sh, .bin) present in OIS web upload directories.
OIS service or child processes spawning shells (/bin/sh, /bin/bash) or network utilities (curl, wget, nc) with root privileges.
Outbound connections from the OIS server to unrecognized external hosts shortly after web upload activity.

Detection Strategies

Review OIS web module access logs for POST requests to upload endpoints from low-privileged accounts, particularly those originating from unexpected network segments.
Correlate authentication events with subsequent file-write and process-execution telemetry on the host to identify upload-to-execution chains.
Baseline the OIS web root and alert on any new or modified files that are not part of a scheduled update.

Monitoring Recommendations

Enable file integrity monitoring on OIS installation directories and web application roots.
Capture process creation events with parent-child relationships so that web-server-spawned shells are visible to analysts.
Forward OIS application logs, host telemetry, and network flow data to a centralized analytics platform for correlation and retention.

How to Mitigate CVE-2026-50093

Immediate Actions Required

Update Siveillance Control Pro V3.0 to V3.0.12.2173 or later, and Siveillance Control Pro V4.0 to V4.0.9.2178 or later.
Update Siveillance Control V3.0 to V3.0.22.2177 or later, and Siveillance Control V4.0 to V4.0.11.2177 or later.
Restrict network access to the OIS web module to trusted management hosts and operator workstations only.
Rotate credentials for all OIS accounts and audit access rights after patching.

Patch Information

Siemens has released fixed versions for all affected product lines. Refer to Siemens Security Advisory SSA-254516 for the authoritative list of fixed versions, download locations, and upgrade guidance. Apply the vendor patch as the primary remediation.

Workarounds

Segment the OIS server onto a dedicated management VLAN protected by firewall rules that block untrusted adjacent-network traffic.
Enforce strong authentication on OIS accounts and remove unused or default operator credentials.
Deploy a reverse proxy or web application firewall in front of the OIS web module to inspect and block suspicious upload requests until patches are applied.

bash

# Example firewall restriction limiting OIS web access to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP