Siemens Siveillance Control Critical Vulnerability: Arbitrary File Upload Leads to Root Access

Siemens ProductCERT disclosed a critical vulnerability in the Open Interface Services (OIS) web module integrated within Siveillance Control and Siveillance Control Pro solutions. The vulnerability, tracked as CVE-2026-50093, stems from unrestricted upload of file with dangerous type (CWE-434) in the OIS web module. Successful exploitation could allow an attacker to upload arbitrary files to the server and subsequently gain root-level access on the host system, potentially leading to a full compromise of the affected OIS environment.

The affected product lines and minimum patched versions are as follows:
- Siveillance Control Pro V3.0: versions before 3.0.12.2173
- Siveillance Control Pro V4.0: versions before 4.0.9.2178
- Siveillance Control V3.0: versions before 3.0.22.2177
- Siveillance Control V4.0: versions before 4.0.11.2177

Siemens has released corresponding patches and updates for each affected version series. Detailed advisory information and download links are available through the Siemens ProductCERT portal, including advisory SSA-254516. CISA has incorporated this vulnerability into its ICS advisory framework (ICSA-26-265-03) and recommends that users minimize network exposure, isolate control system networks behind firewalls, and employ secure remote access methods such as VPNs. As of the disclosure date (2026-09-22), no public exploit code has been confirmed, though the vulnerability type is assessed as high-risk due to the potential for root-level compromise.

The vulnerability impacts critical infrastructure sectors including Critical Manufacturing, Communications, and Commercial Facilities, with deployments reported worldwide. Siemens advises users to apply the available updates promptly and to follow recommended security practices for protecting network-accessible control system devices.