CVE-2024-39567

CWE-77 — Command Injection3 documents3 sources

Severity

8.5HIGH

EPSS

0.4%

top 37.77%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Siemens Sinema Remote Connect Client

Timeline

PublishedJul 9

Description

A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to command injection due to missing server side input sanitation when loading VPN configurations. This could allow an authenticated local attacker to execute arbitrary code with system privileges.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5siemens/sinema_remote_connect_client< V3.2 HF1

▶NVDsiemens/sinema_remote_connect_client< 3.2+1

🔴Vulnerability Details

CVEList

CVE-2024-39567: A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3↗2024-07-09

▶

GHSA

GHSA-qm8q-xxj7-jwh6: A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3↗2024-07-09

▶