PT-2020-2347 · Siemens · Sinvr/Sivms Video Server

Published 2020-03-10 · Updated 2024-01-09 · CVE-2019-19297

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions SiNVR/SiVMS Video Server versions prior to V5.0.0

Description A path traversal vulnerability has been identified in the streaming service of the SiVMS/SiNVR Video Server, which could allow an unauthenticated remote attacker to access and download arbitrary files from the server. The issue is related to incorrect restriction of the path name to a directory with limited access. This could enable a remote attacker to obtain protected information.

Recommendations For versions prior to V5.0.0, update to version V5.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the streaming service on the default port 5410/tcp to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-02315

CVE-2019-19297

Affected Products

Sinvr/Sivms Video Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-19297 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02315 · Security Note