SSA-844761: Multiple Vulnerabilities in SiNVR/SiVMS Video Server
The Video Server application in SiNVR/SiVMS solutions contains five vulnerabilities involving information disclosure (CVE-2019-19291, CVE-2019-19299), path traversal (CVE-2019-19296, CVE-2019-19297), and denial-of-service (CVE-2019-19298). PKE has released updates of the application that fixes the reported vulnerabilities, except for CVE-2019-19299. This update is not available under the former Siemens OEM brand name SiNVR. For details contact PKE ( https://pke.at/).
beschreibt (5)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-19299US | medium5.0 | — | ||
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < V5.0.2), SiNVR/SiVMS Video Server (All v… | ||||
| CVE-2019-19298US | medium5.0 | — | ||
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < V5.0.2). The streaming service (default… | ||||
| CVE-2019-19297US | medium5.0 | — | ||
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The streaming service (default port 5410/tcp) of the SiVMS/SiNVR Video Server
contains a pa… | ||||
| CVE-2019-19296US | medium4.9 | — | ||
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The two FTP services (default ports 21/tcp and 5411/tcp) of the SiVMS/SiNVR Video
Server co… | ||||
| CVE-2019-19291US | low3.5OT erhöht | — | ||
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0). The FTP services of the SiVMS/SiNVR Vi… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-844761: Multiple Vulnerabilities in SiNVR/SiVMS Video Server - CSAF Versionself
- SSA-844761: Multiple Vulnerabilities in SiNVR/SiVMS Video Server - HTML Versionself
- SSA-844761: Multiple Vulnerabilities in SiNVR/SiVMS Video Server - PDF Versionself
- SSA-844761: Multiple Vulnerabilities in SiNVR/SiVMS Video Server - TXT Versionself
Behebungen (11)
- MitigationSiNVR/SiVMS Video Server
Apply ACL/firewall configuration on the Video Servers to ensure that only legitimate systems are able to access the configured server ports. Harden all systems accordingly to prevent unauthorized access Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level)
- MitigationSiNVR/SiVMS Video Server
Apply ACL/firewall configuration on the Video Servers to ensure that only legitimate systems are able to access the configured server ports. Harden all systems accordingly to prevent unauthorized access Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level)
- MitigationSiNVR/SiVMS Video Server
Apply ACL/firewall configuration on the Video Servers to ensure that only legitimate systems are able to access the configured server ports. Harden all systems accordingly to prevent unauthorized access Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level)
- MitigationSiNVR/SiVMS Video Server
Apply ACL/firewall configuration on the Video Servers to ensure that only legitimate systems are able to access the configured server ports. Harden all systems accordingly to prevent unauthorized access Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level)
- MitigationSiNVR/SiVMS Video Server
Apply ACL/firewall configuration on the Video Servers to ensure that only legitimate systems are able to access the configured server ports. Harden all systems accordingly to prevent unauthorized access Consider to apply encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level)
- Kein Fix geplantSiNVR/SiVMS Video Server
Currently no fix is planned
- BehobenSiNVR/SiVMS Video Server
Update to V5.0.0 or later version
- BehobenSiNVR/SiVMS Video Server
Update to V5.0.0 or later version
- BehobenSiNVR/SiVMS Video Server
Update to V5.0.0 or later version
- BehobenSiNVR/SiVMS Video Server
Update to V5.0.0 or later version
- BehobenSiNVR/SiVMS Video Server
Update to V5.0.0 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan