PT-2022-18309 · Siemens · Sinema Remote Connect Server

Published 2022-06-14 · Updated 2022-06-24 · CVE-2022-27220

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V3.0 SP2

Description A security issue has been identified in the SINEMA Remote Connect Server, where the affected application lacks general HTTP security headers in the web server configured on port 6220. This omission could make the servers more susceptible to clickjacking, channel downgrade attacks, and other client-based attack vectors.

Recommendations For versions prior to V3.0 SP2, update to version V3.0 SP2 or later to resolve the issue. As a temporary workaround, consider configuring the web server to include general HTTP security headers until a patch is applied. Restrict access to the web server on port 6220 to minimize the risk of exploitation.

Fix

Clickjacking

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-1021

CWE-358

Related Identifiers

CVE-2022-27220

Affected Products

Sinema Remote Connect Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-27220 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27220 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf · Vendor Advisory