#VU23597 Path traversal in SiNVR 3 Central Control Server (CCS) - CVE-2019-18338

Vulnerability identifier: #VU23597

Vulnerability risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-18338

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
SiNVR 3 Central Control Server (CCS)
Server applications / SCADA systems

Vendor: Siemens

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. A remote authenticated attacker can send a specially crafted HTTP request and list arbitrary directories or read files outside of the CCS application context.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

SiNVR 3 Central Control Server (CCS): All versions

---

External links
http://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.