Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Siemens SiNVR/SiVMS Video Server

CVE-2019-19299
HIGH 7.5

At a glance

Source
NVD
EPSS
EPSS 1.24 % · percentile 69 ()
State
PUBLISHED
Published
Updated
Assigner
siemens
NVD status
Modified

Search on…

Description

A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < V5.0.2), SiNVR/SiVMS Video Server (All versions >= V5.0.2). The streaming service (default port 5410/tcp) of the SiVMS/SiNVR Video Server applies weak cryptography when exposing device (camera) passwords. This could allow an unauthenticated remote attacker to read and decrypt the passwords and conduct further attacks.

Weaknesses (CWE)

  • CWE-326 — Inadequate Encryption Strength

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:Csiemens
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD · productcert@siemens.com (Secondary)
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Secondary)
CVSS 2.0MEDIUM 5.0AV:N/AC:L/Au:N/C:P/I:N/A:NNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Siemens · SiNVR/SiVMS Video Serveraffected All versions < V5.0.0
Siemens · SiNVR/SiVMS Video Serveraffected All versions >= V5.0.0 < V5.0.2
Siemens · SiNVR/SiVMS Video Serveraffected All versions >= V5.0.2

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD