CVE-2019-18340

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0). Both the SiVMS/SiNVR Video Server and the Control Center Server (CCS) store user and device passwords by applying weak cryptography.

A local attacker could exploit this vulnerability to extract the passwords from the user database and/or the device configuration files to conduct further attacks.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
Siemens	Control Center Server (CCS)	All versions < V1.5.0
Siemens	Control Center Server (CCS)	All versions >= V1.5.0
Siemens	SiNVR/SiVMS Video Server	All versions < V5.0.0
Siemens	SiNVR/SiVMS Video Server	All versions >= V5.0.0

References

Timeline

Published: Dec 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-183415.3A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Co CVE-2019-183429.9A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Co CVE-2019-183449.8Sourcecodester Online Grading System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary CVE-2019-183459.3A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker CVE-2019-183468.8A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send CVE-2019-183475.4A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unpr CVE-2019-183486.1An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the at CVE-2019-183499.8HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.CVE-2019-18354.4A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated, local attacker to access sensitive information CVE-2019-183506.1In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of CVE-2019-183528.2Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using CVE-2019-183559.8An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.