Today > vulnerabilities - You can now download lists of IOCs here!

CVE-2024-39867

July 9, 2024, 6:19 p.m.

CVSS Score

7.6 / 10

Product(s) Impacted

SINEMA Remote Connect Server

All versions < V3.2 SP1

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit device configuration information of devices for which they have no privileges.

Weaknesses

CWE-425

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

CWE ID: 425

Date

Published: July 9, 2024, 12:15 p.m.

Last Modified: July 9, 2024, 6:19 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

productcert@siemens.com

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

Base Score

7.6

Exploitability Score

2.8

Impact Score

4.7

Base Severity