CVE-2024-39872

CRITICAL

SINEMA Remote Connect Server <V3.2 SP1 - Privilege Escalation

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'Manage firmware updates' role to escalate their privileges on the underlying OS level.

References (1)

Core 1

Scores

CVSS v3 9.6
EPSS 0.0048
EPSS Percentile 65.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-378
Status published
Products (2)
siemens/sinema_remote_connect_server 3.2 (2 CPE variants)
siemens/sinema_remote_connect_server < 3.2
Published Jul 09, 2024
Tracked Since Feb 18, 2026