Siemens and PKE SiNVR, SiVMS Video Server (Update A)
The HTTP service (default specific port) of the SiNVR 3 Video Server contains an authentication bypass vulnerability, even when properly configured with enforced authentication. CVE-2019-13947, CVE-2019-18337, CVE-2019-18338, CVE-2019-18341, and CVE-2019-18342 have been moved to SSA-761844 and ICSA-21-103-10.CVE-2019-18339 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Both the SiNVR 3 Video Server and the CCS store user and device passwords by applying weak cryptography. CVE-2019-18340 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).. --------- End Update A Part 4 of 6 ---------CVE-2019-18340 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).