CVE-2019-18340CWE-327

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS…

Medium · published December 12, 2019

CVSS v3.1
5.5
EPSS
0%
Percentile
15.5
In the wild
Unconfirmed
What it is

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0). Both the SiVMS/SiNVR Video Server and the Control Center Server (CCS) store

user and device passwords by applying weak cryptography.

A local attacker could exploit this vulnerability to extract

the passwords from the user database and/or the device configuration files

to conduct further attacks.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.5th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2019-12-12T19:08Z
EPSS history
Timeline
  • 12 DEC 19:08Z
    A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS…
    cvelistv5