This vulnerability, identified as CWE-434 (Unrestricted Upload of File with Dangerous Type), affects multiple versions of Siemens Siveillance Control Pro and Siveillance Control products. The flaw exists in the OIS web module, where insufficient restrictions on file uploads enable an attacker with network access and low privileges to upload arbitrary files. Successful exploitation can escalate privileges to root, resulting in complete control over the affected system. The CVSS v3.1 base score is 9.0, reflecting high attack complexity and severe impact on confidentiality, integrity, and availability. Affected versions include all versions prior to V3.0.12.2173 for Siveillance Control Pro V3.0, prior to V4.0.9.2178 for Siveillance Control Pro V4.0, prior to V3.0.22.2177 for Siveillance Control V3.0, and prior to V4.0.11.2177 for Siveillance Control V4.0.

An attacker exploiting this vulnerability can upload arbitrary files to the server, which may lead to root-level access on the host system. This results in a full compromise of the affected OIS environment, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented in the provided data. Users should monitor Siemens advisories for updates and apply patches once available.