CVE-2024-39570: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to…

PriorityP262high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.35%

68.4th percentile

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading VxLAN configurations. This could allow an authenticated attacker to execute arbitrary code with root privileges.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
siemens	sinema_remote_connect_server	< V3.2 HF1	V3.2 HF1
siemens	sinema_remote_connect_server	< 3.2	3.2
siemens	sinema_remote_connect_server	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Detect command injection attempts targeting VxLAN configuration loading in SINEMA Remote Connect Server — look for unsanitized special characters (e.g., semicolons, pipes, backticks) in VxLAN configuration input fields submitted by authenticated users ↗
→Monitor for unexpected processes spawned with root privileges from the SINEMA Remote Connect Server application process, which may indicate successful command injection via VxLAN configuration loading ↗
→Alert on authenticated network requests (low-privilege) to SINEMA Remote Connect Server endpoints responsible for loading VxLAN configurations, especially from external/internet-facing sources ↗

·Vulnerability only affects SINEMA Remote Connect Server versions prior to V3.2 HF1; systems updated to V3.2 HF1 or later are not affected ↗
·Exploitation requires authentication (low-privilege authenticated attacker), so detections should be scoped to authenticated sessions rather than unauthenticated traffic ↗
·No known public exploitation of this vulnerability has been reported at the time of advisory publication ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.