CVE-2019-19299
published 2020-03-10CVE-2019-19299: A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions = V5.0.0 = V5.0.2). The streaming service (default port 5410/tcp) of the…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.21%
64.5th percentile
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions = V5.0.0 = V5.0.2). The streaming service (default port 5410/tcp) of the SiVMS/SiNVR Video Server
applies weak cryptography when exposing device (camera) passwords.
This could allow an unauthenticated remote attacker to read and decrypt
the passwords and conduct further attacks.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | sinvr_sivms_video_server | <= 5.0.2 | — |
| siemens | sinvr_sivms_video_server | — | — |
| siemens | sinvr_sivms_video_server | — | — |
| siemens | sinvr_sivms_video_server | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens and PKE SiNVR/SiVMS Video Server (Update B)
cisa_ics·2021-04-20·CVSS 6.5
[MEDIUM] Siemens and PKE SiNVR/SiVMS Video Server (Update B)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens and PKE SiNVR/SiVMS Video Server (Update B)
Last RevisedAugust 10, 2021
Alert CodeICSA-20-070-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendors: Siemens and PKE
- Equipment: SiNVR/SiVMS Video Server
- Vulnerabilities: Cleartext Storage in a File or on Disk, Path Traversal, Improper Input Validation, Weak Cryptography for Passwords
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-20-070-01 Siemens SiNVR 3 (Update A) that was published April 20, 2021, to the ICS w
GHSA
GHSA-2xrj-wrq4-ff74: A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions)
ghsa_unreviewed·2022-05-24
CVE-2019-19299 [MEDIUM] CWE-326 GHSA-2xrj-wrq4-ff74: A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions)
A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions). The streaming service (default port 5410/tcp) of the SiNVR 3 Video Server applies weak cryptography when exposing device (camera) passwords. This could allow an unauthenticated remote attacker to read and decrypt the passwords and conduct further attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-03-10
Published