CVE-2026-3014: Unauthenticated RCE in Siemens Siveillance Video — Detection and Remediation Guide

---
title: Siveillance Video Server Process Spawning Shell - Possible CVE-2026-3014 Exploitation
id: 8c4f2a1b-3d7e-4f9a-b2c6-9e1d5a7b3c41
status: experimental
description: Detects Windows command shells or scripting engines spawned as child processes of Siveillance Video server or associated web service processes, consistent with post-exploitation behavior following OS command injection against a video management server.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-09
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\java.exe'
      - '\javaw.exe'
      - '\tomcat.exe'
    ParentCommandLine|contains:
      - 'siveillance'
      - 'vms'
      - 'video'
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_shell
falsepositives:
  - Legitimate Siveillance maintenance scripts or health-check diagnostics spawning shells from the service context; verify against change records
level: high
---
title: Encoded or Obfuscated Command Execution on Video Management Servers
id: 2f7b9c3d-5a1e-4d8f-a6b2-7c9e3d1f4a85
status: experimental
description: Detects encoded PowerShell, download cradles, or living-off-the-land command patterns on servers identified as video management systems, indicating possible second-stage payload delivery after command injection exploitation such as CVE-2026-3014.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-09
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - ' -enc '
      - ' -ec '
      - 'FromBase64String'
      - 'IEX('
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'WebClient'
      - 'curl.exe http'
      - 'certutil -urlcache'
  filter_legit:
    CommandLine|contains:
      - 'SCCM'
      - 'IntuneManagementExtension'
  condition: selection_cmd and not filter_legit
falsepositives:
  - Software deployment tooling using encoded commands; restrict deployment scope to VMS server assets via asset tags
level: medium
---
title: Webshell or Script File Creation in Web-Accessible Siveillance Directories
id: 6d3a8f2c-1b4e-4c7a-9d5f-2e8a6b1c7d93
status: experimental
description: Detects creation of executable script files in web-accessible directories on video management servers, a common persistence and remote access mechanism following OS command injection exploitation.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-09
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\Siveillance\'
      - '\SiveillanceVideo\'
      - '\www\'
      - '\htdocs\'
      - '\webapps\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asp'
      - '.php'
      - '.jsp'
      - '.jspx'
      - '.war'
      - '.cgi'
  condition: selection_path and selection_ext
falsepositives:
  - Vendor software updates and hotfix installations; correlate with authorized maintenance windows
level: high

let lookback = 14d;
let vmsServers = dynamic(["SIVEILLANCE", "VMS", "VIDEO-MGMT"]);
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","curl.exe","whoami.exe","net.exe","nltest.exe"]);
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where DeviceName has_any (vmsServers)
| where InitiatingProcessFileName in~ ("w3wp.exe","httpd.exe","nginx.exe","java.exe","javaw.exe","tomcat.exe")
   or InitiatingProcessCommandLine has_any ("siveillance","video")
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, ProcessId, ReportId
| order by TimeGenerated desc

let lookback = 14d;
CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where DeviceAction in~ ("allow","allowed","Accept") or isempty(DeviceAction)
| where DestinationHostName has_any ("SIVEILLANCE","VMS","VIDEO")
   or DestinationIP in (todynamic('["10.0.0.0"]')) // replace with VMS server IPs
| where not(ipv4_is_private(SourceIP))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort, ApplicationProtocol
| order by ConnectionCount desc

-- Hunt for post-exploitation process execution and network activity on Siveillance Video VMS servers
LET suspicious_children = '(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe)'
LET service_parents = '(?i)(w3wp\.exe|httpd\.exe|nginx\.exe|java\.exe|javaw\.exe|tomcat\.exe|siveillance)'

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ suspicious_children
   OR CommandLine =~ suspicious_children

SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status = 'ESTABLISHED'
  AND NOT RemoteAddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

# CVE-2026-3014 - Siveillance Video vulnerability verification and triage
# Run elevated on each Video Management Server

$fixedBaseline = @{
    'V2023 R3' = [version]'23.3.27'
    'V2024 R1' = [version]'24.1.16'
    'V2025'    = [version]'25.1.15'
}

Write-Host "=== [1] Installed Siveillance Video version ===" -ForegroundColor Cyan
$apps = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
                         "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -match 'Siveillance' } |
        Select-Object DisplayName, DisplayVersion, InstallDate, Publisher

if (-not $apps) {
    Write-Host "[!] No Siveillance Video installation detected on this host." -ForegroundColor Yellow
} else {
    $apps | Format-Table -AutoSize
    foreach ($app in $apps) {
        $ver = $null
        [void][version]::TryParse(($app.DisplayVersion -split ' ')[0], [ref]$ver)
        if ($ver -and $ver -lt [version]'25.1.15' -and $ver -lt [version]'24.1.16' -and $ver -lt [version]'23.3.27') {
            Write-Host "[VULNERABLE] $($app.DisplayName) $($app.DisplayVersion) is below ALL fixed baselines - PATCH IMMEDIATELY" -ForegroundColor Red
        } elseif ($ver -and ($ver.Major -eq 23 -and $ver -lt [version]'23.3.27')) {
            Write-Host "[VULNERABLE] V2023 R3 build below 23.3.27 - PATCH IMMEDIATELY" -ForegroundColor Red
        } elseif ($ver -and ($ver.Major -eq 24 -and $ver -lt [version]'24.1.16')) {
            Write-Host "[VULNERABLE] V2024 R1 build below 24.1.16 - PATCH IMMEDIATELY" -ForegroundColor Red
        } elseif ($ver -and ($ver.Major -eq 25 -and $ver -lt [version]'25.1.15')) {
            Write-Host "[VULNERABLE] V2025 build below 25.1.15 - PATCH IMMEDIATELY" -ForegroundColor Red
        } else {
            Write-Host "[OK] Build appears at or above a fixed baseline. Confirm release train with Siemens advisory." -ForegroundColor Green
        }
    }
}

Write-Host "`n=== [2] Web-accessible script files modified in last 30 days ===" -ForegroundColor Cyan
$webPaths = @("C:\inetpub\wwwroot","C:\Program Files\Siemens","C:\Program Files\Siveillance","C:\Siveillance")
foreach ($p in $webPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.aspx,*.ashx,*.asp,*.php,*.jsp,*.cgi -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            Select-Object FullName, LastWriteTime, Length
    }
}

Write-Host "`n=== [3] Service/web processes with shell children (live) ===" -ForegroundColor Cyan
Get-CimInstance Win32_Process |
    Where-Object { $_.Name -match 'cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|bitsadmin' } |
    ForEach-Object {
        $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue
        if ($parent -and $parent.Name -match 'w3wp|httpd|nginx|java|tomcat|siveillance') {
            [PSCustomObject]@{
                Child = $_.Name; ChildCmd = $_.CommandLine
                Parent = $parent.Name; ParentCmd = $parent.CommandLine
            }
        }
    } | Format-List

Write-Host "`n=== [4] Established connections to non-private IPs from service processes ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|0\.0\.0\.0)' } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
    Sort-Object RemoteAddress -Unique | Format-Table -AutoSize

Write-Host "`n=== Triage complete. Escalate any VULNERABLE flags or suspicious findings to IR immediately. ===" -ForegroundColor Cyan