CVE-2024-39571
published 2024-07-09CVE-2024-39571: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to…
PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.31%
67.5th percentile
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading SNMP configurations. This could allow an attacker with the right to modify the SNMP configuration to execute arbitrary code with root privileges.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | sinema_remote_connect_server | < V3.2 HF1 | V3.2 HF1 |
| siemens | sinema_remote_connect_server | < 3.2 | 3.2 |
| siemens | sinema_remote_connect_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for command injection attempts via SNMP configuration loading in SINEMA Remote Connect Server — missing server-side input sanitization allows arbitrary OS commands to be injected and executed with root privileges ↗
- →Alert on authenticated low-privilege user activity that modifies SNMP configuration on SINEMA Remote Connect Server, particularly any input containing shell metacharacters or command separators ↗
- →Detect network-originated (AV:N), low-complexity (AC:L), low-privilege (PR:L) exploitation attempts against SINEMA Remote Connect Server SNMP configuration endpoint — CVSS v3.1 vector indicates no user interaction required ↗
- ·All versions of SINEMA Remote Connect Server prior to V3.2 HF1 are affected; the vulnerability is in the SNMP configuration loading path specifically ↗
- ·No known public exploitation has been reported at time of advisory publication, reducing immediate threat urgency but not eliminating risk ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEMA Remote Connect Server
cisa_ics·2024-07-11·CVSS 8.7
[HIGH] Siemens SINEMA Remote Connect Server
ICS Advisory
##
Siemens SINEMA Remote Connect Server
Release DateJuly 11, 2024
Alert CodeICSA-24-193-09
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEMA Remote Connect Server
- Vulnerabilities: Command Injection
## 2. RISK EVALUATION
Successful exploitation of these v
GHSA
GHSA-38pp-mf7x-c483: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3
ghsa_unreviewed·2024-07-09
CVE-2024-39571 [HIGH] CWE-77 GHSA-38pp-mf7x-c483: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading SNMP configurations. This could allow an attacker with the right to modify the SNMP configuration to execute arbitrary code with root privileges.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-09
Published