Sign-up

ID

VAR-202407-0142


CVE

CVE-2024-39871


TITLE

Siemens'  SINEMA Remote Connect Server  Fraud related to unauthorized authentication in

Trust: 0.8

sources: JVNDB: JVNDB-2024-007475

DESCRIPTION

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly separate the rights to edit device settings and to edit settings for communication relations. This could allow an authenticated attacker with the permission to manage devices to gain access to participant groups that the attacked does not belong to. The platform is mainly used for remote access, maintenance, control and diagnosis of underlying networks

Trust: 2.16

sources: NVD: CVE-2024-39871 // JVNDB: JVNDB-2024-007475 // CNVD: CNVD-2024-31250

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-31250

AFFECTED PRODUCTS

vendor:siemensmodel:sinema remote connect serverscope:ltversion:3.2

Trust: 1.0

vendor:siemensmodel:sinema remote connect serverscope:eqversion:3.2

Trust: 1.0

vendor:シーメンスmodel:sinema remote connect serverscope:eqversion:3.2

Trust: 0.8

vendor:シーメンスmodel:sinema remote connect serverscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:sinema remote connect serverscope:eqversion: -

Trust: 0.8

vendor:siemensmodel:sinema remote connect server sp1scope:ltversion:v3.2

Trust: 0.6

sources: CNVD: CNVD-2024-31250 // JVNDB: JVNDB-2024-007475 // NVD: CVE-2024-39871

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2024-39871
value: MEDIUM

Trust: 1.0

productcert@siemens.com: CVE-2024-39871
value: MEDIUM

Trust: 1.0

NVD: CVE-2024-39871
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2024-31250
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2024-31250
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2024-39871
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.5
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2024-39871
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.4
version: 3.1

Trust: 1.0

NVD: CVE-2024-39871
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-31250 // JVNDB: JVNDB-2024-007475 // NVD: CVE-2024-39871 // NVD: CVE-2024-39871

PROBLEMTYPE DATA

problemtype:CWE-863

Trust: 1.0

problemtype:Illegal authentication (CWE-863) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-007475 // NVD: CVE-2024-39871

PATCH

title:Patch for Siemens SINEMA Remote Connect Server Improper Authorization Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/567796

Trust: 0.6

sources: CNVD: CNVD-2024-31250

EXTERNAL IDS

db:NVDid:CVE-2024-39871

Trust: 3.2

db:SIEMENSid:SSA-381581

Trust: 2.4

db:ICS CERTid:ICSA-24-193-01

Trust: 0.8

db:JVNid:JVNVU99298639

Trust: 0.8

db:JVNDBid:JVNDB-2024-007475

Trust: 0.8

db:CNVDid:CNVD-2024-31250

Trust: 0.6

sources: CNVD: CNVD-2024-31250 // JVNDB: JVNDB-2024-007475 // NVD: CVE-2024-39871

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-381581.html

Trust: 2.4

url:https://jvn.jp/vu/jvnvu99298639/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-39871

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-01

Trust: 0.8

sources: CNVD: CNVD-2024-31250 // JVNDB: JVNDB-2024-007475 // NVD: CVE-2024-39871

SOURCES

db:CNVDid:CNVD-2024-31250
db:JVNDBid:JVNDB-2024-007475
db:NVDid:CVE-2024-39871

LAST UPDATE DATE

2024-09-10T20:20:45.556000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-31250date:2024-07-10T00:00:00
db:JVNDBid:JVNDB-2024-007475date:2024-09-09T01:16:00
db:NVDid:CVE-2024-39871date:2024-09-06T18:32:01.667

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-31250date:2024-07-11T00:00:00
db:JVNDBid:JVNDB-2024-007475date:2024-09-09T00:00:00
db:NVDid:CVE-2024-39871date:2024-07-09T12:15:18.833