CVE-2024-39872

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'Manage firmware updates' role to escalate their privileges on the underlying OS level.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-381581.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:sinema_remote_connect_server::::::::
	cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:-::::::
	cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:hf1::::::

History

09 Sep 2024, 15:24

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (todas las versiones < V3.2 SP1). La aplicación afectada no asigna correctamente derechos a los archivos temporales creados durante su proceso de actualización. Esto podría permitir que un atacante autenticado con la función 'Manage firmware updates' escale sus privilegios en el nivel del sistema operativo subyacente.
CPE		cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:-:::::: cpe:2.3:a:siemens:sinema_remote_connect_server:::::::: cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:hf1::::::
CVSS	v2 : ~~unknown~~ v3 : ~~9.6~~	v2 : unknown v3 : 9.9
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-381581.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-381581.html - Patch, Vendor Advisory
CWE		NVD-CWE-Other
First Time		Siemens Siemens sinema Remote Connect Server

09 Jul 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-09 12:15

Updated : 2024-09-09 15:24

NVD link : CVE-2024-39872

Mitre link : CVE-2024-39872

CVE.ORG link : CVE-2024-39872

JSON object : View

Products Affected

siemens

sinema_remote_connect_server

CWE

NVD-CWE-Other CWE-378

Creation of Temporary File With Insecure Permissions

{"id": "CVE-2024-39872", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 9.3, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "HIGH", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "HIGH", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-07-09T12:15:19.070", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-381581.html", "tags": ["Patch", "Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-378"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'Manage firmware updates' role to escalate their privileges on the underlying OS level."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (todas las versiones < V3.2 SP1). La aplicaci\u00f3n afectada no asigna correctamente derechos a los archivos temporales creados durante su proceso de actualizaci\u00f3n. Esto podr\u00eda permitir que un atacante autenticado con la funci\u00f3n 'Manage firmware updates' escale sus privilegios en el nivel del sistema operativo subyacente."}], "lastModified": "2024-09-09T15:24:26.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA2839E7-E397-4D69-865B-439F0017D540", "versionEndExcluding": "3.2"}, {"criteria": "cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CBBACB4-9C5A-4616-BD70-FEDEE9978BFC"}, {"criteria": "cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:hf1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9B79132-ECF2-4519-9D07-28DB6B0ABE2C"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}