VDB
CVE-2024-39865
CVE-2024-39865
PUBLISHED
CVSS 8.800000190734863 HIGH
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. As part of this backup, files can be restored without correctly checking the path of the restored file. This could allow an attacker with access to the backup encryption key to upload malicious files, that could potentially lead to remote code execution.
EPSS 0.45% · 37.7th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
EPSS Score
0.45%
37.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SINEMA Remote Connect Server | 0, 0, 0 |
| siemens | sinema_remote_connect_server | 3.2, 3.2, 3.2 |
| siemens | sinema_remote_connect_server | 0, 0, 0 |
Timeline
- Jul 9, 2024 CVE Published
- Jul 9, 2024 PoC Published
- Jul 10, 2024 EPSS Score
- Aug 1, 2024 EPSS Score
- Sep 15, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 7, 2024 EPSS Score
- Oct 29, 2024 EPSS Score
- Dec 14, 2024 EPSS Score
- Jan 5, 2025 EPSS Score
- Jan 27, 2025 EPSS Score
- Mar 13, 2025 EPSS Score