VDB
CVE-2024-39569
CVE-2024-39569
PUBLISHED
CVSS 6.599999904632568 MEDIUM
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to command injection due to missing server side input sanitation when loading VPN configurations. This could allow an administrative remote attacker running a corresponding SINEMA Remote Connect Server to execute arbitrary code with system privileges on the client system.
EPSS 2.45% · 85.5th percentile
Risk Scores
CVSS 3.1
6.599999904632568
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
EPSS Score
2.45%
85.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| siemens | sinema_remote_connect_client | 0, 0, 0 |
| siemens | sinema_remote_connect_client | 0, 3.2, 0 |
| Siemens | SINEMA Remote Connect Client | 0, 0, 0 |
Exploit Intelligence
- CIRCL seen: CVE-2024-39569 (circl-sighting)
- https://cert-portal.siemens.com/productcert/html/ssa-868282.html (circl)
Timeline
- Jul 9, 2024 CVE Published
- Jul 9, 2024 PoC Published
- Jul 10, 2024 EPSS Score
- Aug 1, 2024 EPSS Score
- Sep 14, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 6, 2024 EPSS Score
- Nov 19, 2024 EPSS Score
- Nov 21, 2024 CVE Updated
- Dec 12, 2024 EPSS Score
- Jan 3, 2025 EPSS Score
- Feb 16, 2025 EPSS Score