PT-2022-21178 · Siemens · Sinema Remote Connect Server

Published 2022-06-14 · Updated 2024-07-09 · CVE-2022-32252

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V3.1

Description A vulnerability has been identified where the application does not perform integrity checks of update packages. This could allow an admin user to be tricked into installing a malicious package, potentially granting root privileges to an attacker.

Recommendations For versions prior to V3.1, update to version V3.1 or later to resolve the issue. As a temporary workaround, consider validating update packages manually before installation to minimize the risk of exploitation. Restrict access to the update package installation process to authorized personnel only.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2022-32252

Affected Products

Sinema Remote Connect Server

References · 4

• https://osv.dev/vulnerability/CVE-2022-32252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32252 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-484086.html · Note