ID
VAR-202407-0141
CVE
CVE-2024-39868
TITLE
Siemens SINEMA Remote Connect Server Forced Browsing Vulnerability (CNVD-2024-31230)
Trust: 0.6
DESCRIPTION
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit VxLAN configuration information of networks for which they have no privileges. The platform is mainly used for remote access, maintenance, control and diagnosis of underlying networks. Attackers can exploit this vulnerability to access and edit the VxLAN configuration information of the network they do not have permission to
Trust: 1.44
IOT TAXONOMY
| category: | ['ICS'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | siemens | model: | sinema remote connect server sp1 | scope: | lt | version: | v3.2 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-425 | Trust: 1.0 |
PATCH
| title: | Patch for Siemens SINEMA Remote Connect Server Forced Browsing Vulnerability (CNVD-2024-31230) | url: | https://www.cnvd.org.cn/patchInfo/show/567771 | Trust: 0.6 |
EXTERNAL IDS
| db: | SIEMENS | id: | SSA-381581 | Trust: 1.6 |
| db: | NVD | id: | CVE-2024-39868 | Trust: 1.6 |
| db: | CNVD | id: | CNVD-2024-31230 | Trust: 0.6 |
REFERENCES
| url: | https://cert-portal.siemens.com/productcert/html/ssa-381581.html | Trust: 1.6 |
SOURCES
| db: | CNVD | id: | CNVD-2024-31230 |
| db: | NVD | id: | CVE-2024-39868 |
LAST UPDATE DATE
2024-08-14T12:49:02.055000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-31230 | date: | 2024-07-10T00:00:00 |
| db: | NVD | id: | CVE-2024-39868 | date: | 2024-07-09T18:19:14.047 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-31230 | date: | 2024-07-12T00:00:00 |
| db: | NVD | id: | CVE-2024-39868 | date: | 2024-07-09T12:15:18.157 |