Vulnerability · Published Jul 9, 2024 · Assigned by siemens
CVE-2024-39867
High 7.6
In plain English
A high-severity security flaw in SINEMA Remote Connect Server from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit device configuration information of devices for which they have no privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SINEMA Remote Connect Server | 0 – before V3.2 SP1 |
Weakness: CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C