Sign-up

ID

VAR-202407-0141


CVE

CVE-2024-39868


TITLE

Siemens'  SINEMA Remote Connect Server  Direct request submission vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2024-007662

DESCRIPTION

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit VxLAN configuration information of networks for which they have no privileges. Siemens' SINEMA Remote Connect Server contains a direct request submission vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The platform is mainly used for remote access, maintenance, control and diagnosis of underlying networks. Attackers can exploit this vulnerability to access and edit the VxLAN configuration information of the network they do not have permission to

Trust: 2.16

sources: NVD: CVE-2024-39868 // JVNDB: JVNDB-2024-007662 // CNVD: CNVD-2024-31230

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-31230

AFFECTED PRODUCTS

vendor:siemensmodel:sinema remote connect serverscope:ltversion:3.2

Trust: 1.0

vendor:siemensmodel:sinema remote connect serverscope:eqversion:3.2

Trust: 1.0

vendor:シーメンスmodel:sinema remote connect serverscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:sinema remote connect serverscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:sinema remote connect serverscope:eqversion:3.2

Trust: 0.8

vendor:siemensmodel:sinema remote connect server sp1scope:ltversion:v3.2

Trust: 0.6

sources: CNVD: CNVD-2024-31230 // JVNDB: JVNDB-2024-007662 // NVD: CVE-2024-39868

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2024-39868
value: HIGH

Trust: 1.0

productcert@siemens.com: CVE-2024-39868
value: HIGH

Trust: 1.0

NVD: CVE-2024-39868
value: HIGH

Trust: 0.8

CNVD: CNVD-2024-31230
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-31230
severity: HIGH
baseScore: 8.0
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2024-39868
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 3.4
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2024-39868
baseSeverity: HIGH
baseScore: 7.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 4.7
version: 3.1

Trust: 1.0

NVD: CVE-2024-39868
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-31230 // JVNDB: JVNDB-2024-007662 // NVD: CVE-2024-39868 // NVD: CVE-2024-39868

PROBLEMTYPE DATA

problemtype:CWE-425

Trust: 1.0

problemtype:Direct request submission (CWE-425) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-007662 // NVD: CVE-2024-39868

PATCH

title:Patch for Siemens SINEMA Remote Connect Server Forced Browsing Vulnerability (CNVD-2024-31230)url:https://www.cnvd.org.cn/patchInfo/show/567771

Trust: 0.6

sources: CNVD: CNVD-2024-31230

EXTERNAL IDS

db:NVDid:CVE-2024-39868

Trust: 3.2

db:SIEMENSid:SSA-381581

Trust: 2.4

db:ICS CERTid:ICSA-24-193-01

Trust: 0.8

db:JVNid:JVNVU99298639

Trust: 0.8

db:JVNDBid:JVNDB-2024-007662

Trust: 0.8

db:CNVDid:CNVD-2024-31230

Trust: 0.6

sources: CNVD: CNVD-2024-31230 // JVNDB: JVNDB-2024-007662 // NVD: CVE-2024-39868

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-381581.html

Trust: 2.4

url:https://jvn.jp/vu/jvnvu99298639/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-39868

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-01

Trust: 0.8

sources: CNVD: CNVD-2024-31230 // JVNDB: JVNDB-2024-007662 // NVD: CVE-2024-39868

SOURCES

db:CNVDid:CNVD-2024-31230
db:JVNDBid:JVNDB-2024-007662
db:NVDid:CVE-2024-39868

LAST UPDATE DATE

2024-09-11T20:03:26.843000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-31230date:2024-07-10T00:00:00
db:JVNDBid:JVNDB-2024-007662date:2024-09-10T01:30:00
db:NVDid:CVE-2024-39868date:2024-09-09T15:20:25.113

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-31230date:2024-07-12T00:00:00
db:JVNDBid:JVNDB-2024-007662date:2024-09-10T00:00:00
db:NVDid:CVE-2024-39868date:2024-07-09T12:15:18.157