Medium severity · published Mar 12, 2024
CVE-2024-22045
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1)
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1). The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. This information is also available via the web interface of the product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SR
Sinema Remote Connect Client · Siemens
before 3.1; 3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22045
Patch
https://cert-portal.siemens.com/productcert/html/ssa-653855.html
More from Sinema Remote Connect Client
9.8
CVE-2024-33698
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1…
9.8
CVE-2019-3822
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow
8.6
CVE-2024-2398
HTTP/2 push headers memory-leak
7.8
CVE-2024-39568
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1)
7.8
CVE-2024-39567
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1)