A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions). Both the SiNVR 3 Video Server and the Central Control Server (CCS) store user and device passwords by applying weak cryptography. A local attacker could exploit this vulnerability to extract the passwords from the user database and/or the device configuration files to conduct further attacks.

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-18340
• https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf