The vulnerability of the central control server of SiNVR 3 Central Control Server (CCS) arises from an incorrect path name limitation in the web interface download section, which allows a hacker to gain access to the server’s file system, enabling them to download files from the server and copy files from the server.

The vulnerability of the central control server of SiNVR 3 Central Control Server CCS is related to an incorrect path name limitation in the web interface download section, leading to access to restricted directories. Exploiting this vulnerability could allow a malicious actor to gain access to t...

The vulnerability of the central control server of SiNVR 3 allows a hacker to read or modify the database of the central control server, as well as perform operations on the databases or operating system commands with administrator privileges.

The vulnerability of the central control server of SiNVR 3 Central Control Server lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to remotely read or modify the central control server’s database, as well as perform operations o...

The vulnerability of the Central Control Server (CCS) and the Video Server of Siemens’ SiNVR 3 solution, related to the unencrypted storage of user credentials, allows a intruder to gain unauthorized access to users’ credentials.

The vulnerability of the Central Control Server CCS and the Video Server of Siemens’ SiNVR 3 solution for video management involves unencrypted storage of user credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to users’...

The vulnerability of the central control server of SiNVR 3 Central Control Server lies in security flaws in the XML-based communication protocol, allowing attackers to perform arbitrary actions on the vulnerable device.

The vulnerability of the central control server of SiNVR 3 Central Control Server is related to security vulnerabilities in the XML-based communication protocol. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

CVE-2020-12834

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...

CVE-2020-12834

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...

Connected Home Hubs Open Houses to Full Remote Takeover

Three different connected home hubs – Fibaro Home Center Lite, Homematic Central Control Unit CCU2 and Elko’s eLAN-RF-003 – are vulnerable in their older versions to serious bugs that would allow information disclosure, man-in-the-middle MiTM attacks and unauthenticated remote code execution RCE,...

Siemens SiNVR 3 Insufficient Records Vulnerability

SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 has an insufficient security operation logging vulnerability in the XML-based communication protocol implementation, which can be exploited by a remote...

Siemens SiNVR 3 Cross-Site Scripting Vulnerability

SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 has a reflected cross-site scripting vulnerability in its implementation, which can be exploited by remote attackers to obtain sensitive data or perform...

PT-2020-2445 · Unknown · Control Center Server +2

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 SiNVR 3 Central Control Server all versions SiNVR 3 Video Server all versions Description: A reflected Cross-site Scripting XSS vulnerability has been identified in the web interface of the...

PT-2020-2442 · Sinvr · Sinvr 3 Central Control Server +1

Name of the Vulnerable Software and Affected Versions: SiNVR 3 Central Control Server CCS versions prior to V1.5.0 SiNVR 3 Video Server all versions Description: A path traversal vulnerability exists in the DOWNLOADS section of the web interface of the Control Center Server CCS. This vulnerabilit...

PT-2020-2447 · Sinvr · Sinvr 3 Central Control Server +2

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 SiNVR 3 Central Control Server all versions SiNVR 3 Video Server all versions Description: A vulnerability has been identified in the Control Center Server CCS and SiNVR 3 Central Control...

PT-2019-15357 · Sinvr · Sinvr 3 Central Control Server +2

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 SiNVR 3 Central Control Server CCS all versions SiNVR 3 Video Server all versions Description: A directory traversal vulnerability has been identified in the XML-based communication protocol ...

Siemens SiNVR 3 Central Control Server (CCS) Directory Traversal Vulnerability

SiNVR is the Siemens OEM version of SiVMS, a video management solution acquired by PKE Deutsch land gmmbH and formerly distributed by Schille Informationssysteme gmmbH. Siemens SiNVR 3 Central Control Server CCS has a directory traversal vulnerability in its xml-based communication protocol. An...

Siemens SiNVR 3 Central Control Server (CCS) Authentication Bypass Vulnerability

SiNVR is the Siemens OEM version of SiVMS, a video management solution acquired by PKE Deutsch land gmmbH and formerly distributed by Schille Informationssysteme gmmbH. Siemens SiNVR 3 Central Control Server CCS has an authentication bypass vulnerability in its xml-based communication protocol. A...

Siemens SiNVR 3 Video Server and SiNVR 3 Central Control Server (CCS) Information Disclosure Vulnerability

SiNVR is the Siemens OEM version of SiVMS, a video management solution acquired by PKE Deutsch land gmmbH and formerly distributed by Schille Informationssysteme gmmbH. An information disclosure vulnerability exists in Siemens SiNVR 3 Video Server and SiNVR 3 Central Control Server CCS. A local...

Siemens SiNVR 3 Central Control Server (CCS) Authentication Bypass Vulnerability

SiNVR is the Siemens OEM version of SiVMS, a video management solution acquired by PKE Deutsch land gmmbH and formerly distributed by Schille Informationssysteme gmmbH. An authentication bypass vulnerability exists in the SFTP service default port 22/tcp of the Siemens SiNVR 3 Central Control...

CVE-2019-10121

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin...

CVE-2018-7298

In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position which could be...

Pacom RTU/1000 CCU/EMCS Encryption Weak Password Vulnerability

The Pacom 1000 CCU and RTU are both products of the Swedish company Pacom. The former is a set of network security panels for controlling, monitoring and maintaining remote sites and the latter is a set of security panels for controlling access control alarm systems. A security vulnerability exis...