PT-2019-15358 · Siemens · Sinvr/Sivms Video Server

Published 2019-12-12 · Updated 2024-01-09 · CVE-2019-18339

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiNVR/SiVMS Video Server versions prior to V5.0.0

Description A vulnerability has been identified in the HTTP service of the SiVMS/SiNVR Video Server, which contains an authentication bypass issue. This allows a remote attacker with network access to the Video Server to exploit the vulnerability and read the SiVMS/SiNVR users database, including the passwords of all users in obfuscated cleartext.

Recommendations For versions prior to V5.0.0, update to version V5.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP service on the default port 5401/tcp to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-18339

Affected Products

Sinvr/Sivms Video Server

References · 2

• https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18339 · Security Note