CVE-2024-39873

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39873
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its web API. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-381581.html Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-381581.html Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:-:*:*:*:*:*:*
cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:hf1:*:*:*:*:*:*
History

21 Nov 2024, 09:28

Type Values Removed Values Added
References () https://cert-portal.siemens.com/productcert/html/ssa-381581.html - Patch, Vendor Advisory () https://cert-portal.siemens.com/productcert/html/ssa-381581.html - Patch, Vendor Advisory

09 Sep 2024, 15:25

Type Values Removed Values Added
Summary
  • (es) Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (todas las versiones &lt; V3.2 SP1). La aplicación afectada no implementa correctamente la protección de fuerza bruta contra las credenciales de usuario en su API web. Esto podría permitir a un atacante conocer las credenciales de usuario que son vulnerables a ataques de fuerza bruta.
CPE cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:hf1:*:*:*:*:*:*
cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:-:*:*:*:*:*:*
References () https://cert-portal.siemens.com/productcert/html/ssa-381581.html - () https://cert-portal.siemens.com/productcert/html/ssa-381581.html - Patch, Vendor Advisory
First Time Siemens sinema Remote Connect Server
Siemens

09 Jul 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-09 12:15

Updated : 2024-11-21 09:28

NVD link : CVE-2024-39873

Mitre link : CVE-2024-39873

CVE.ORG link : CVE-2024-39873

JSON object : View

Products Affected

siemens

  • sinema_remote_connect_server
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts