PT-2020-2348 · Siemens · Sinvr/Sivms Video Server

Published 2020-03-10 · Updated 2024-01-09 · CVE-2019-19298

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SiNVR/SiVMS Video Server versions prior to V5.0.0 SiNVR/SiVMS Video Server versions V5.0.0 through V5.0.1

Description A vulnerability has been identified in the streaming service of the SiVMS/SiNVR Video Server, which contains an input validation issue. This could allow an unauthenticated remote attacker to cause a Denial-of-Service condition by sending malformed HTTP requests to the default port 5410/tcp.

Recommendations For versions prior to V5.0.0, update to version V5.0.0 or later. For versions V5.0.0 through V5.0.1, update to version V5.0.2 or later. As a temporary workaround, consider restricting access to the streaming service on port 5410/tcp to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-02316

CVE-2019-19298

Affected Products

Sinvr/Sivms Video Server

References · 3

• https://bdu.fstec.ru/vul/2020-02316 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19298 · Security Note