A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions). The streaming service (default port 5410/tcp) of the SiNVR 3 Video Server applies weak cryptography when exposing device (camera) passwords. This could allow an unauthenticated remote attacker to read and decrypt the passwords and conduct further attacks.

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-19299
• https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf