PT-2020-2447 · Sinvr · Sinvr 3 Video Server+2

Published 2020-03-10 · Updated 2024-01-09 · CVE-2019-19295

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Control Center Server (CCS) versions prior to V1.5.0 SiNVR 3 Central Control Server (all versions) SiNVR 3 Video Server (all versions)

Description A vulnerability has been identified in the Control Center Server (CCS) and SiNVR 3 Central Control Server, related to errors in the XML-based communication protocol. This vulnerability allows an authenticated remote attacker to perform covert actions that are not visible in the application log, as the server does not enforce logging of security-relevant activities on ports 5444/tcp and 5440/tcp.

Recommendations For Control Center Server (CCS) versions prior to V1.5.0, update to version V1.5.0 or later to resolve the issue. For SiNVR 3 Central Control Server and SiNVR 3 Video Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to ports 5444/tcp and 5440/tcp to minimize the risk of exploitation.

Weakness Enumeration

CWE-778

Related Identifiers

BDU:2020-02457

CVE-2019-19295

Affected Products

Control Center Server

Sinvr 3 Central Control Server

Sinvr 3 Video Server

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19295 · Security Note
• https://bdu.fstec.ru/vul/2020-02457 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf · Note
• https://t.me/cvenotify/13150 · Telegram Post