High severity · published Jul 9, 2024
CVE-2024-39567
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1)
7.8
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to command injection due to missing server side input sanitation when loading VPN configurations. This could allow an authenticated local attacker to execute arbitrary code with system privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SR
Sinema Remote Connect Client · Siemens
before 3.2; 3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39567
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-868282.html
More from Sinema Remote Connect Client
9.8
CVE-2024-33698
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1…
9.8
CVE-2019-3822
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow
8.6
CVE-2024-2398
HTTP/2 push headers memory-leak
7.8
CVE-2024-39568
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1)
7.5
CVE-2018-16890
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read