No technological development is completely exempt from any security flaw. A report by participants of a hacking course mentions the finding of at least ten critical vulnerabilities in the Siemens SiNVR 3 video surveillance system.
The aforementioned system is affected by various exploitable flaws ranging from SQL injections, XSS attacks and input validation errors, among others. Below is a brief explanation of the most dangerous vulnerabilities that were found.
Path traversal: This is a medium severity vulnerability that exists due to an input validation error when processing directory cross-streams. A remote threat actor might send a malicious HTTP request to read arbitrary files on the system.
This flaw was tracked as CVE-2019-19290 and at the moment there are no patches or possible workarounds, mention members of the hacking course.
Sensitive information storage in clear text: This medium severity flaw, tracked as CVE-2019-19291, exists due to a feature enabled by default on the affected product. A remote hacker could access highly sensitive information without encountering major obstacles in the system if the FTP service is enabled.
SQL Injection: Tracked as CVE-2019-19292, it allows remote hackers to send specially designed requests to the affected application to execute arbitrary SQL commands within the application database.
This is a high severity flaw, as its successful exploitation allows threat actors to read, delete or modify the data and gain control of the affected database. As with previous reports, there are no known methods to mitigate the risk of exploitation yet.
XSS Attacks: This flaw, tracked as CVE-2019-19293, would allow remote hackers to perform XSS attacks by redirecting victims with specially designed links to then execute arbitrary code in the target user’s browser.
If exploited, this flaw would allow phishing attacks, extract sensitive information, show malvertising, among other malicious activities; it is worth mentioning that the risk of exploitation of this flaw is low, experts report the hacking course.
Insufficient Logging: Tracked as CVE-2019-19295, this vulnerability allows remote hackers to compromise the target system by performing various malicious actions in a stealth manner. There is no known mitigation.
Cryptographic issues: This vulnerability exists due to the weakness of encryption in the affected product, and allows remote threat actors to decrypt passwords on the system. The fault was tracked as CVE-2019-19229.
The International Institute of Cyber Security (IICS) reminds users of affected deployments that there are no security patches or workarounds available, so it is recommended to stay on top of the official announcements of the company.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
