Summary
The Video Server application in SiNVR/SiVMS solutions contains two vulnerabilities
involving authentication bypass (CVE-2019-18339) and information disclosure (CVE-2019-18340).
PKE has released an update of the application that fixes CVE-2019-18339.
This update is not available under the former Siemens OEM brand name SiNVR. For details contact PKE (
https://pke.at/).
Siemens recommends specific countermeasures to mitigate the vulnerabilities.
Vulnerabilities 2
-
Critical 9.8
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port…
-
Medium 5.5
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS)…
Revision history
-
#3
Cleanup: removed orphaned links to vendor advisories and software downloads
-
#2
Added partial solution for SiNVR/SiVMS Video Server; removed information for Control Center Server (CCS), which is now addressed in SSA-761844
-
#1
Publication Date
References
-
SSA-761617: Authentication Bypass and Information Disclosure Vulnerabilities in SiNVR/SiVMS Video Server - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-761617.html
-
SSA-761617: Authentication Bypass and Information Disclosure Vulnerabilities in SiNVR/SiVMS Video Server - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf
-
SSA-761617: Authentication Bypass and Information Disclosure Vulnerabilities in SiNVR/SiVMS Video Server - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-761617.txt