PT-2020-2000 · Siemens · Sinema Server

Antonin Rahon · Published 2020-01-14 · Updated 2021-09-20 · CVE-2019-10940

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SINEMA Server versions prior to V14.0 SP2 Update 1

Description A security issue has been identified that could allow an attacker with a valid session and low privileges to perform administrative operations, such as firmware updates, on connected devices. The issue can be exploited by an attacker with network access to the system, who must have access to a low-privileged account. This could compromise the confidentiality, integrity, and availability of the affected system and its components. At the time of reporting, no public exploitation of this issue was known.

Recommendations For versions prior to V14.0 SP2 Update 1, update to V14.0 SP2 Update 1 or later to resolve the issue. As a temporary workaround, consider restricting access to low-privileged accounts and limiting network access to the affected system to minimize the risk of exploitation.

Fix

Incorrect Privilege Assignment

Improper Privilege Management

Weakness Enumeration

CWE-266

CWE-269

Related Identifiers

BDU:2020-01385

CVE-2019-10940

Affected Products

Sinema Server

References · 5

• https://osv.dev/vulnerability/CVE-2019-10940 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-880233.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01385 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10940 · Security Note
• https://us-cert.gov/ics/advisories/icsa-20-014-02 · Note