PT-2024-2616 · Siemens · Sinema Remote Connect Server

Published 2024-03-12 · Updated 2026-06-08 · CVE-2022-32257

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V3.2

Description A vulnerability has been identified in the SINEMA Remote Connect Server, where the web service lacks proper access control for some endpoints. This could lead to unauthorized access to resources and potentially allow code execution. The issue is related to insufficient access control, which could be exploited by a remote attacker to execute arbitrary code.

Recommendations For versions prior to V3.2, update to version V3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the web service endpoints to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-02683

CVE-2022-32257

Affected Products

Sinema Remote Connect Server

References · 7

• https://bdu.fstec.ru/vul/2024-02683 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-576771.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32257 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32257 · Vendor Advisory
• https://twitter.com/CVEnew/status/1767503938373468484 · Twitter Post
• https://twitter.com/HugoValters/status/2063865858905260335 · Twitter Post
• https://twitter.com/cracbot/status/1767989709450465472 · Twitter Post