CVE-2019-19299CWE-326

A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < V5.0.2)…

High · published March 10, 2020

CVSS v3.1
7.5
EPSS
1%
Percentile
68.9
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < V5.0.2), SiNVR/SiVMS Video Server (All versions >= V5.0.2). The streaming service (default port 5410/tcp) of the SiVMS/SiNVR Video Server

applies weak cryptography when exposing device (camera) passwords.

This could allow an unauthenticated remote attacker to read and decrypt

the passwords and conduct further attacks.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.01237 · 68.9th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2020-03-10T19:16Z
EPSS history
Timeline
  • 10 MAR 19:16Z
    A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < V5.0.2)…
    cvelistv5