{"id":"CVE-2019-19291","aliases":["EUVD-2019-8915","GHSA-42wf-qrfc-c5m5"],"status":"published","title":"A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR...","description":"A vulnerability has been identified in Control Center Server (CCS) (All versions \u003c V1.5.0), SiNVR/SiVMS Video Server (All versions \u003c V5.0.0). The FTP services of the SiVMS/SiNVR Video Server and the Control Center Server (CCS) maintain\nlog files that store login credentials in cleartext.\nIn configurations where the FTP service is enabled, authenticated remote\nattackers could extract login credentials of other users of the service.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00749,"percentile":0.5522,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-312","CWE-313"],"published":"2020-03-10T19:16:17Z","modified":"2026-06-17T02:26:26Z","products":[{"vendor":"siemens","product":"control center server (ccs)"},{"vendor":"siemens","product":"sinvr/sivms video server"},{"vendor":"siemens","product":"sinvr_3_central_control_server"},{"vendor":"siemens","product":"sinvr_3_video_server"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19291"},{"url":"https://github.com/advisories/GHSA-42wf-qrfc-c5m5"}],"sources":{"cve":[{"id":"CVE-2019-19291","description":"A vulnerability has been identified in Control Center Server (CCS) (All versions \u003c V1.5.0), SiNVR/SiVMS Video Server (All versions \u003c V5.0.0). The FTP services of the SiVMS/SiNVR Video Server and the Control Center Server (CCS) maintain\nlog files that store login credentials in cleartext.\nIn configurations where the FTP service is enabled, authenticated remote\nattackers could extract login credentials of other users of the service.","status":"published","published":"2020-03-10T19:16:17Z","modified":"2024-08-05T02:09:39.7Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-313"],"updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-8915","description":"A vulnerability has been identified in Control Center Server (CCS) (All versions \u003c V1.5.0), SiNVR/SiVMS Video Server (All versions \u003c V5.0.0). The FTP services of the SiVMS/SiNVR Video Server and the Control Center Server (CCS) maintain\nlog files that store login credentials in cleartext.\nIn configurations where the FTP service is enabled, authenticated remote\nattackers could extract login credentials of other users of the service.","status":"published","published":"2020-03-10T19:16:17Z","modified":"2024-08-05T02:09:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C","level":"medium"}],"updated_at":"2026-11-03T02:40:25.841101Z"}],"ghsa":[{"id":"GHSA-42wf-qrfc-c5m5","title":"A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR...","description":"A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions). The FTP service of the SiNVR 3 Central Control Server (CCS) maintains a log file that stores login credentials in cleartext. In configurations where the FTP service is enabled, authenticated remote attackers could extract login credentials of other users of the service.","status":"published","published":"2022-05-24T17:10:36Z","modified":"2024-01-18T05:06:25Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-312","CWE-313"],"updated_at":"2026-11-02T14:55:26.125732Z"}],"nvd":[{"id":"CVE-2019-19291","description":"A vulnerability has been identified in Control Center Server (CCS) (All versions \u003c V1.5.0), SiNVR/SiVMS Video Server (All versions \u003c V5.0.0). The FTP services of the SiVMS/SiNVR Video Server and the Control Center Server (CCS) maintain\nlog files that store login credentials in cleartext.\nIn configurations where the FTP service is enabled, authenticated remote\nattackers could extract login credentials of other users of the service.","status":"published","published":"2020-03-10T20:15:19.18Z","modified":"2026-06-17T02:26:26.583Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-313","CWE-312"],"updated_at":"2026-11-02T14:05:45.254119Z"}]}}