A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. This could allow an attacker with access to the backup encryption key and with the right to upload backup files to create a user with administrative privileges.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSiemens Sinema Remote Connect Server
APPSiemens3.2< 3.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2021-40438CRITICAL9.0⚠ KEVPL ✓same product
SSRF w mod_proxy Apache HTTP Server — przekierowanie żądań przez atakującego
CVE-2024-39872CRITICAL9.3PL ✓same product
Privilege escalation w SINEMA Remote Connect Server przez tymczasowe pliki aktualizacji
CVE-2022-32257CRITICAL9.8PL ✓same product
Siemens SINEMA Remote Connect Server — brak kontroli dostępu prowadzący do RCE
CVE-2022-25315CRITICAL9.8PL ✓same product
Integer overflow w libexpat (storeRawNames) — RCE bez uwierzytelnienia
CVE-2022-25235CRITICAL9.8PL ✓same product
Brak walidacji kodowania UTF-8 w bibliotece Expat (libexpat)