CVE-2019-18340

Summary

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0). Both the SiVMS/SiNVR Video Server and the Control Center Server (CCS) store user and device passwords by applying weak cryptography.

A local attacker could exploit this vulnerability to extract the passwords from the user database and/or the device configuration files to conduct further attacks.

Affected Software

VendorProductVersion RangeStatus
SiemensControl Center Server (CCS)All versions < V1.5.0affected
SiemensControl Center Server (CCS)All versions >= V1.5.0affected
SiemensSiNVR/SiVMS Video ServerAll versions < V5.0.0affected
SiemensSiNVR/SiVMS Video ServerAll versions >= V5.0.0affected

Weaknesses

  • CWE-327: CWE-327: Use of a Broken or Risky Cryptographic Algorithm

ADP Enrichment

CVE Program Container

Additional References

References