CVE-2024-39872

CWE-3783 documents3 sources
Severity
9.3CRITICAL
EPSS
0.5%
top 35.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Siemens Sinema Remote Connect Server
Timeline
PublishedJul 9

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'Manage firmware updates' role to escalate their privileges on the underlying OS level.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H

Affected Packages2 packages

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p74h-fjjv-jrm8: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3↗2024-07-09
▶
CVEList
CVE-2024-39872: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3↗2024-07-09
▶
CVE-2024-39872 (CRITICAL CVSS 9.3) | A vulnerability has been identified | cvebase.io