Read the docs
TI-2019-13916 Aliases CVE-2019-19296GHSA-5q84-q9g2-g3jr

Path traversal in Siemens SiNVR/SiVMS Video Server

Priority LOW 39CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The two FTP services (default ports 21/tcp and 5411/tcp) of the SiVMS/SiNVR Video Server contain a path traversal vulnerability that could allow an authenticated remote attacker to access and download arbitrary files from the server, if the FTP services are enabled.

Why it matters now

EPSS 0.01812 78th percentileScored 2026-11-07
Fix Fixed SiNVR/SiVMS Video Server (Siemens): V5.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSiNVR/SiVMS Video Serverbefore V5.0.0V5.0.0Patch availableCNA
  • SiNVR/SiVMS Video Server VendorSiemens Affected before V5.0.0 Fixed in V5.0.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:siemens:sinvr_3_central_control_server:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:sinvr_3_video_server:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
  • cpe:2.3:a:siemens:sinvr_3_central_control_server:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinvr_3_video_server:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens

Remediation

  • Fix · CNA SiNVR/SiVMS Video Server (Siemens) Fixed in V5.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19296
  2. 2026-10-03 Alias added: GHSA-5q84-q9g2-g3jr

References

Advisory 1

  • TI-2019-13345 Improper authentication in Siemens Control Center Server CVSS 3.1CRITICAL 9.8
  • TI-2019-13347 Missing authentication in Siemens SiNVR/SiVMS Video Server CVSS 3.1CRITICAL 9.8
  • TI-2019-13912 SQL injection in Siemens Control Center Server CVSS 3.1HIGH 8.8
  • TI-2019-13346 Path traversal in Siemens Control Center Server CVSS 3.1HIGH 7.7
  • TI-2019-13917 Path traversal in Siemens SiNVR/SiVMS Video Server CVSS 3.1HIGH 7.5
  • TI-2019-13910 Path traversal in Siemens Control Center Server CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences