Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-13947: Control Center Server before v1.5 sends passwords in clear

CVE-2019-13947 · published 6 years ago

Summary

The web interface of Control Center Server versions earlier than 1.5 transmits user passwords in readable form to the browser. Anyone with admin access to the interface could view other users' passwords, not just reset them. Upgrade to version 1.5 or later, or apply the vendor's patch, and ensure administrative accounts are restricted.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
siemens	sinvr_3_central_control_server	All versions `cpe:2.3:a:siemens:sinvr_3_central_control_server::::::::`
siemens	sinvr_3_video_server	All versions `cpe:2.3:a:siemens:sinvr_3_video_server::::::::`

Original advisory text

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The user configuration menu in the web interface of the
Control Center Server (CCS) transfers user passwords in clear to the
client (browser).

An attacker with administrative privileges for the web interface could be
able to read (and not only reset) passwords of other CCS users.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-317Cleartext Storage of Sensitive Information in GUI

CWE-312Cleartext Storage of Sensitive Information

Timeline

Published12 Dec 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-13947 · NVD

Track software like this

Free during beta