Path Traversal Vulnerability in Siveillance Video DLNA Server

An attacker with valid credentials could read files outside the intended directory structure on the DLNA server, potentially exposing sensitive configuration data, recordings, or system files that could be used for further attacks.

Security operations centers and video surveillance facilities using Siemens Siveillance Video systems should prioritize this advisory. Affected sites rely on DLNA servers for streaming and managing surveillance video feeds; compromised servers could expose recordings and access patterns that impact physical security monitoring capability.

An attacker must first obtain valid authentication credentials for the DLNA server. They then craft specially formatted file path requests containing directory traversal sequences (such as "../") to access files outside the normal service directory. The server processes these requests without proper path validation and returns unauthorized files.