CVE-2019-18339
highPriorität · verfolgen · 31OT-Risiko · erhöhtEPSS 0.027 · 86. PerzentilDEEUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port 5401/tcp) of the SiVMS/SiNVR Video Server contains an authentication bypass vulnerability, even when properly configured with enforced authentication. A remote attacker with network access to the Video Server could exploit this vulnerability to read the SiVMS/SiNVR users database, including the passwords of all users in obfuscated cleartext.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSiNVR/SiVMS Video Serversiemens_psirt
Update to V5.0.0 or later version
- BehobenSiNVR 3 Central Control Server (CCS)cisa_csaf_ot
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens ' operational guidelines for industrial security and to following the recommendations in the product manuals.
- BehobenSiNVR/SiVMS Video Servercisa_csaf_ot
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens ' operational guidelines for industrial security and to following the recommendations in the product manuals.
- MitigationSiNVR/SiVMS Video Serversiemens_psirt
Apply ACL/firewall configuration on the Video Servers to ensure that only legitimate systems are able to access the configured server ports. Harden all systems accordingly to prevent unauthorized access
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.4–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (10)
Betroffene Produkte und Versionsbereiche.
- siemens sinvr 3 central control serveralle VersionennvdUScpe:2.3:a:siemens:sinvr_3_central_control_server:*:*:*:*:*:*:*:*
- siemens sinvr 3 video serveralle VersionennvdUScpe:2.3:a:siemens:sinvr_3_video_server:*:*:*:*:*:*:*:*
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-761617SSA-761617: Authentication Bypass and Information Disclosure Vulnerabilities in SiNVR/SiVMS Video Server2019-12-10csaf · siemens_psirtDE
The Video Server application in SiNVR/SiVMS solutions contains two vulnerabilities involving authentication bypass (CVE-2019-18339) and information disclosure (CVE-2019-18340). PKE has released an update of the application that fixes CVE-2019-18339. This update is not available under the former Siemens OEM brand name SiNVR. For details contact PKE ( https://pke.at/). Siemens recommends specific countermeasures to mitigate the vulnerabilities.
- ICSA-19-344-02Siemens and PKE SiNVR, SiVMS Video Server (Update A)2019-12-10icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to read the SiVMS/SiNVR users database, including the passwords of all users in obfuscated cleartext and configuration files.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-18339cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-19-344-02cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.4625/cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-19-344-01cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-19-344-02cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdfVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan