Siemens Siveillance Video Management Servers Critical OS Command Injection Vulnerability

Siemens Siveillance Video Management Servers are affected by a critical vulnerability identified as CVE-2026-3014. The vulnerability stems from improper neutralization of special elements used in an OS command, commonly known as OS command injection. According to the advisory published by CISA and Siemens, users with edit permissions to the Management Server could potentially execute arbitrary code in the context of the Management Server Service.

The issue impacts three major product lines: Siveillance Video V2023 R3 (versions before 23.3.27), Siveillance Video V2024 R1 (versions before 24.1.16), and Siveillance Video V2025 (versions before 25.1.15). The CVSS v3.1 base score is 9.1 (Critical), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating network-adjacent attack vector, low complexity, high-privilege requirements, and high impacts on confidentiality, integrity, and availability.

Siemens has addressed the vulnerability by releasing hotfix updates. Affected customers are advised to update to V23.3 HotfixRev27 or later, V24.1 HotfixRev16 or later, or V25.1 HotfixRev15 or later, depending on their current product version. Advisory links are provided by Siemens for each product line. As a general security measure, Siemens and CISA recommend protecting network access to affected products and following recommended security practices to run devices in a protected IT environment. No public exploitation of CVE-2026-3014 has been reported as of the advisory release date.