Path traversal in Siemens Siveillance Video DLNA Server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video DLNA Server (2020 R1), Siveillance Video DLNA Server (2020 R2), Siveillance Video DLNA Server (2020 R3), Siveillance Video DLNA Server (2021 R1). The affected application contains a path traversal vulnerability that could allow to read arbitrary files on the server that are outside the application’s web document directory. An unauthenticated remote attacker could exploit this issue to access sensitive information for subsequent attacks.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Siveillance Video DLNA Server | 2019 R1 | — | No fix listed | CNA |
| Siemens | Siveillance Video DLNA Server | 2019 R2 | — | No fix listed | CNA |
| Siemens | Siveillance Video DLNA Server | 2019 R3 | — | No fix listed | CNA |
| Siemens | Siveillance Video DLNA Server | 2020 R1 | — | No fix listed | CNA |
| Siemens | Siveillance Video DLNA Server | 2020 R2 | — | No fix listed | CNA |
| Siemens | Siveillance Video DLNA Server | 2020 R3 | — | No fix listed | CNA |
| Siemens | Siveillance Video DLNA Server | 2021 R1 | — | No fix listed | CNA |
- Siveillance Video DLNA Server VendorSiemens Affected 2019 R1 Fixed in — No fix listed CNA
- Siveillance Video DLNA Server VendorSiemens Affected 2019 R2 Fixed in — No fix listed CNA
- Siveillance Video DLNA Server VendorSiemens Affected 2019 R3 Fixed in — No fix listed CNA
- Siveillance Video DLNA Server VendorSiemens Affected 2020 R1 Fixed in — No fix listed CNA
- Siveillance Video DLNA Server VendorSiemens Affected 2020 R2 Fixed in — No fix listed CNA
- Siveillance Video DLNA Server VendorSiemens Affected 2020 R3 Fixed in — No fix listed CNA
- Siveillance Video DLNA Server VendorSiemens Affected 2021 R1 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:siveillance_video_management_software_2019_r1:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_management_software_2019_r2:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_management_software_2019_r3:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_management_software_2020_r1:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:a:siemens:siveillance_video_management_software_2020_r2:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siveillance_video_dlna_server:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:a:siemens:siveillance_video_management_software_2019_r1:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_management_software_2019_r2:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_management_software_2019_r3:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_management_software_2020_r1:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:a:siemens:siveillance_video_management_software_2020_r2:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:siveillance_video_dlna_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42021
- 2026-10-03 Alias added: GHSA-p86h-xf2r-jw9g
References
More Siemens Siveillance Video Management Software 2019 R1 vulnerabilities
- TI-2019-04633 Missing authorization in Siemens Siveillance VMS 2017 R2 CVSS 3.1CRITICAL 9.8
- TI-2019-04634 Improper authorization in Siemens Siveillance VMS 2017 R2 CVSS 3.1HIGH 8.8
- TI-2019-04635 Improper authorization in Siemens Siveillance VMS 2017 R2 CVSS 3.1HIGH 7.1
Sources
- CVE-2021-42021 · CVE Program
- CVE-2021-42021 · NVD
- FIRST EPSS
- GHSA-p86h-xf2r-jw9g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences