CVE-2024-39571

CWE-77 — Command Injection3 documents3 sources
Severity
8.7HIGH
EPSS
1.5%
top 18.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Siemens Sinema Remote Connect Server
Timeline
PublishedJul 9

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading SNMP configurations. This could allow an attacker with the right to modify the SNMP configuration to execute arbitrary code with root privileges.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-38pp-mf7x-c483: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3↗2024-07-09
▶
CVEList
CVE-2024-39571: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3↗2024-07-09
▶
CVE-2024-39571 (HIGH CVSS 8.7) | A vulnerability has been identified | cvebase.io