PT-2020-2346 · Siemens · Sinvr/Sivms Video Server

Published 2020-03-10 · Updated 2024-01-09 · CVE-2019-19296

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions SiNVR/SiVMS Video Server versions prior to V5.0.0

Description A path traversal vulnerability has been identified in the FTP services of the SiVMS/SiNVR Video Server. This vulnerability could allow an authenticated remote attacker to access and download arbitrary files from the server if the FTP services are enabled. The issue is related to incorrect restriction of the directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to access protected information.

Recommendations For versions prior to V5.0.0, update to version V5.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the FTP services on the default ports 21/tcp and 5411/tcp until a patch is available. Restrict access to the FTP services to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-02314

CVE-2019-19296

Affected Products

Sinvr/Sivms Video Server

References · 3

• https://bdu.fstec.ru/vul/2020-02314 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-19296 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf · Vendor Advisory