Vulnerability · Published Feb 9, 2022 · Assigned by siemens
CVE-2022-23102
Medium 6.1
In plain English
A medium-severity open redirect in SINEMA Remote Connect Server from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.7% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)4.7%top 8.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SINEMA Remote Connect Server | All versions < V2.0 |
Weakness: CWE-601
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-654775.pdf x_refsource_MISC
- 20220210 SEC Consult SA-20220209 :: Open Redirect in Login Page in SIEMENS-SINEMA Remote Connect mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/165966/SIEMENS-SINEMA-Remote-Connect-1.0-SP3-HF1-Open-Redirection.html x_refsource_MISC