CVE-2015-1595: Infoleak
The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1595?
CVE-2015-1595 is classified as a high severity vulnerability due to its potential for exploitation by man-in-the-middle attacks.
How do I fix CVE-2015-1595?
To fix CVE-2015-1595, update the Siemens SPCanywhere application to the latest version that implements encryption for system ID to IP address lookups.
What types of devices are affected by CVE-2015-1595?
CVE-2015-1595 affects Siemens SPCanywhere applications running on Android and iOS devices with specific versions up to 1.4 and 1.4.1.
What can an attacker do with CVE-2015-1595?
An attacker exploiting CVE-2015-1595 can intercept client-server communications to discover alarm IP addresses and potentially spoof server responses.
Is there a workaround for CVE-2015-1595?
Currently, there is no documented workaround for CVE-2015-1595 other than updating to a fixed version of the application.