Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Siemens SiPass Integrated allows low‑privilege user to alter server files

CVE-2017-9940 · published 9 years ago
Summary

All versions of Siemens SiPass Integrated earlier than V2.70 let someone with a basic user account read or change files on the server over the network. This could let an attacker view sensitive information or modify system settings. Upgrade to version V2.70 or later, or apply the vendor's patch, to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
siemens sipass_integrated <= 2.65
cpe:2.3:a:siemens:sipass_integrated:*:sp2:*:*:*:*:*:*
Original advisory text
A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with access to a low-privileged user account to read or write files on the file ...
A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with access to a low-privileged user account to read or write files on the file system of the SiPass integrated server over the network.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published8 Aug 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-9940 · NVD
Track software like this
Free during beta