cbcvebase.
CVE-2019-10940
published 2020-01-16

CVE-2019-10940: A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid…

PriorityP261critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
1.21%
64.8th percentile
A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid session, with low privileges, to perform firmware updates and other administrative operations on connected devices. The security vulnerability could be exploited by an attacker with network access to the affected system. An attacker must have access to a low privileged account in order to exploit the vulnerability. An attacker could use the vulnerability to compromise confidentiality, integrity, and availability of the affected system and underlying components. At the time of advisory publication no public exploitation of this security vulnerability was known.

Affected

3 ranges
VendorProductVersion rangeFixed in
siemenssinema_server< 14.014.0
siemenssinema_server——
siemens_agsinema_server——

Detection & IOCsextracted from sources · hover to see the quote

port443/TCP↗
  • →Monitor for low-privileged session tokens being used to invoke firmware update or administrative operations on SINEMA Server — this indicates privilege escalation via incorrect session validation. ↗
  • →Alert on inbound connections to SINEMA Server port 443/TCP originating from untrusted or unexpected IP addresses, as the attack vector is network-accessible over HTTPS. ↗
  • ·No public exploits were known at the time of advisory publication; exploitation requires a valid (low-privileged) account on the SINEMA Server instance. ↗
  • ·All SINEMA Server versions prior to V14.0 SP2 Update 1 are affected; the fix is to upgrade to that specific version. ↗

CVSS provenance

nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.