A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions). The FTP service of the SiNVR 3 Central Control Server (CCS) maintains a log file that stores login credentials in cleartext. In configurations where the FTP service is enabled, authenticated remote attackers could extract login credentials of other users of the service.

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-19291
• https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf