Full Report
The Video Server application in SiNVR/SiVMS solutions contains five vulnerabilities involving information disclosure (CVE-2019-19291, CVE-2019-19299), path traversal (CVE-2019-19296, CVE-2019-19297), and denial-of-service (CVE-2019-19298). PKE has released updates of the application that fixes the reported vulnerabilities, except for CVE-2019-19299. This update is not available under the former Siemens OEM brand name SiNVR. For details see PKE Security Advisory at https://sivms.cloud/wp-content/uploads/2021/03/sivms-cve-fixes_1.0_EN.pdf Siemens recommends specific countermeasures to mitigate the vulnerabilities.
Analysis Summary
# Vulnerability: Multiple Security Flaws in SiNVR/SiVMS Video Server
## CVE Details
* **CVE-2019-19291**: Information Disclosure (CVSS 5.3)
* **CVE-2019-19299**: Information Disclosure (CVSS 5.3)
* **CVE-2019-19296**: Path Traversal (CVSS 7.5)
* **CVE-2019-19297**: Path Traversal (CVSS 7.5)
* **CVE-2019-19298**: Denial-of-Service (CVSS 7.5)
* **Severity**: High (Cumulative)
* **CWE**: CWE-22 (Path Traversal), CWE-200 (Information Exposure), CWE-400 (Resource Exhaustion)
## Affected Systems
* **Products**:
* SiVMS Video Server (PKE)
* SiNVR Video Server (Siemens OEM)
* **Versions**: All versions prior to the latest PKE updates.
* **Configurations**: Systems accessible via the network where the Video Server application is active.
## Vulnerability Description
The Video Server application within these solutions suffers from three distinct classes of security flaws:
1. **Path Traversal (CVE-2019-19296, CVE-2019-19297):** Insufficient validation of user-supplied input allows attackers to access files and directories stored outside the intended web root directory.
2. **Information Disclosure (CVE-2019-19291, CVE-2019-19299):** The application may leak sensitive configuration or system information to unauthorized users.
3. **Denial-of-Service (CVE-2019-19298):** A flaw in request handling allows an attacker to crash the video server or consume excessive resources, rendering the surveillance system unavailable.
## Exploitation
* **Status**: PoC existence not explicitly detailed in provided context; however, vulnerabilities are documented in vendor advisories.
* **Complexity**: Low to Medium.
* **Attack Vector**: Network (Remote).
## Impact
* **Confidentiality**: High (Access to unauthorized files and system info).
* **Integrity**: None/Low (Primarily read/access focused).
* **Availability**: High (Total loss of video server functionality via DoS).
## Remediation
### Patches
* **SiVMS (PKE):** Update to the latest version released by PKE. These updates address all vulnerabilities *except* CVE-2019-19299.
* **SiNVR (Siemens):** No direct software updates are available for the legacy Siemens-branded SiNVR. Users are advised to migrate to supported PKE versions or apply mitigations.
### Workarounds
* **Network Segmentation:** Restrict access to the Video Server to trusted internal networks only.
* **Firewalling:** Block unauthorized access to the ports utilized by the Video Server application.
* **Least Privilege:** Ensure the service runs with the minimum necessary system permissions to limit the scope of path traversal.
## Detection
* **Indicators of Compromise:** Unusual HTTP GET requests containing `../` or `..\` sequences in web logs.
* **Detection Methods:** Monitor for service crashes or unexpected restarts (DoS) and audit file access logs for sensitive system files being requested by the Video Server process.
## References
* PKE Security Advisory: hxxps[://]sivms[.]cloud/wp-content/uploads/2021/03/sivms-cve-fixes_1.0_EN[.]pdf
* Siemens Security Advisory: [Available via Siemens ProductCERT]