CVE-2024-39567: A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is...
Description
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to command injection due to missing server side input sanitation when loading VPN configurations. This could allow an authenticated local attacker to execute arbitrary code with system privileges.
Classification
CVE ID: CVE-2024-39567
CVSS Base Severity: HIGH
CVSS Base Score: 7.8
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')Affected Products
Vendor: Siemens
Product: SINEMA Remote Connect Client
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.44% (probability of being exploited)
EPSS Percentile: 62.03% (scored less or equal to compared to others)
EPSS Date: 2025-05-30 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact:
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-39567https://cert-portal.siemens.com/productcert/html/ssa-868282.html