1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Siemens
- Equipment: SiNVR 3
- Vulnerabilities: Path Traversal, Cleartext Storage in a File or on Disk, SQL Injection, Cross-site Scripting, Insufficient Logging Improper Input Validation, Weak Cryptography for Passwords
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in unauthorized access to server data and possible denial-of-service conditions.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of SiNVR 3, a video management platform, are affected:
- SiNVR 3 Central Control Server (CCS): all versions
- SiNVR 3 Video Server: all versions
3.2 VULNERABILITY OVERVIEW
3.2.1 PATH TRAVERSAL CWE-22
Successful exploitation could allow an authenticated remote attacker to access and download arbitrary files from the server.
CVE-2019-19290 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
3.2.2 CLEARTEXT STORAGE IN A FILE OR ON DISK CWE-313
The affected product maintains a log file that stores login credentials in cleartext. Authenticated remote attackers could extract login credentials of other users of the service.
CVE-2019-19291 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
3.2.3 SQL INJECTION CWE-89
The affected product contains an SQL injection vulnerability in its XML-based communication protocol as provided by default. An authenticated remote attacker could read or modify the database and execute administrative database operations or operating system commands.
CVE-2019-19292 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
3.2.4 CROSS-SITE SCRIPTING CWE-79
The affected product contains a reflected cross-site scripting (XSS) vulnerability that could allow an unauthenticated remote attacker to steal sensitive data or execute administrative actions on behalf of a legitimate administrator.
CVE-2019-19293 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N).
3.2.5 CROSS-SITE SCRIPTING CWE-79
The affected product contains multiple stored cross-site scripting (XSS) vulnerabilities in several input fields. This could allow an authenticated remote attacker to inject malicious JavaScript code.
CVE-2019-19294 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N).
3.2.6 INSUFFICIENT LOGGING CWE-778
The affected device does not enforce logging of security-relevant activities in the XML-based communication protocol. An authenticated remote attacker could perform covert actions not visible in the application log.
CVE-2019-19295 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
3.2.7 PATH TRAVERSAL CWE-22
Successful exploitation could allow an authenticated remote attacker to access and download arbitrary files from the server, if the FTP services are enabled.
CVE-2019-19296 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
3.2.8 PATH TRAVERSAL CWE-22
Successful exploitation could allow an authenticated remote attacker to access and download arbitrary files from the server.
CVE-2019-19297 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
3.2.9 IMPROPER INPUT VALIDATION CWE-20
Successful exploitation could allow an unauthenticated remote attacker to cause a denial-of-service condition by sending malformed HTTP requests.
CVE-2019-19298 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
3.2.10 WEAK CRYPTOGRAPHY FOR PASSWORDS CWE-261
The affected product contains weak cryptography when exposing device passwords. This could allow an unauthenticated remote attacker to read and decrypt the passwords and conduct further attacks.
CVE-2019-19299 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
3.3 BACKGROUND
• CRITICAL INFRASTRUCTURE SECTORS: Information Technology
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER
Siemens reported these vulnerabilities to CISA.
4. MITIGATIONS
Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:
- Apply ACL/firewall configuration on the SiNVR Video and CCS servers to ensure that only legitimate SiNVR systems can access the configured video/CCS server ports.
- Harden all SiNVR systems accordingly to prevent unauthorized access.
- Consider applying encryption and authentication on the network (e.g., via TLS on application level or via IPSec on host level).
- Disable the web interface of CCS if not used. Alternatively, restrict access from local host only, or only to trusted hosts of CCS administrators.
- Enable TLS for the web interface of CCS.
- Disable the FTP service of the CCS.
- Disable the two FTP services of the video server.
As a general security measure Siemens strongly recommends protecting network access to affected products with appropriate mechanisms. Siemens advises users to follow recommended security practices in order to run the devices in a protected IT environment.
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact Siemens ProductCERT.
For more information on these vulnerabilities, please see Siemens security advisory SSA-844761
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
- Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
- Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.
- Exercise principles of least privilege.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
- Do not click web links or open unsolicited attachments in email messages.
- Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
- Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploits specifically target these vulnerabilities.
Source: