Eine Schwachstelle wurde in SiNVR/SiVMS Video Server (Alle Versionen < V5.0.0) identifiziert. Der HTTP-Dienst (Standardport 5401/tcp) des SiVMS/SiNVR Video Servers enthält eine Authentifizierungs-Bypass-Schwachstelle

The primary impact of CVE-2019-18339 is the potential for unauthorized access to sensitive user credentials. An attacker exploiting this vulnerability can bypass authentication mechanisms and directly access the SiVMS/SiNVR user database. This database contains user accounts and their corresponding passwords, which are stored in an obfuscated, but ultimately readable, format. Successful exploitation could lead to complete compromise of the video surveillance system, enabling attackers to view live feeds, modify recordings, and potentially gain control of other connected devices. The cleartext nature of the obfuscated passwords significantly increases the risk of credential theft and subsequent lateral movement within the network.

Organizations utilizing SiNVR/SiVMS Video Server for surveillance, particularly those with legacy deployments or those who have not implemented robust network segmentation, are at significant risk. Shared hosting environments where multiple customers share the same SiNVR/SiVMS instance are also vulnerable, as a compromise of one customer could potentially expose the credentials of others.

• windows / server: Monitor network traffic for connections to port 5401/tcp from unauthorized sources. Use Windows Defender to search for suspicious processes attempting to access the SiVMS/SiNVR database. • linux / server: Use ss -tulnp | grep 5401 to identify processes listening on port 5401. Examine system logs for authentication failures or unusual access attempts. • generic web: Use curl -I <videoserverip>:5401 to check for the presence of the HTTP service and attempt to access it without authentication.

1. 2019-12-12Disclosure

   disclosure

1. Reserviert2019-10-23
2. Veröffentlicht2019-12-12
3. Geändert2024-08-05
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2019-18339 is to upgrade SiNVR/SiVMS Video Server to version 5.0.0 or later. If upgrading is not immediately feasible, consider implementing network segmentation to restrict access to the Video Server. Firewall rules should be configured to limit inbound traffic to port 5401/tcp from only trusted sources. While not a complete solution, monitoring network traffic for unusual connections to port 5401/tcp can provide early warning signs of potential exploitation attempts. After upgrading, verify the fix by attempting to access the Video Server's HTTP service without valid credentials; authentication should be enforced.