CVE-2019-10940
First published: Thu Jan 16 2020(Updated: )
A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid session, with low privileges, to perform firmware updates and other administrative operations on connected devices. The security vulnerability could be exploited by an attacker with network access to the affected system. An attacker must have access to a low privileged account in order to exploit the vulnerability. An attacker could use the vulnerability to compromise confidentiality, integrity, and availability of the affected system and underlying components. At the time of advisory publication no public exploitation of this security vulnerability was known.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens SINEMA Server | <14.0 | |
| Siemens SINEMA Server | =14.0 | |
| Siemens SINEMA Server | =14.0-sp1 | |
| Siemens SINEMA Server | =14.0-sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-10940?
The severity of CVE-2019-10940 is critical with a severity value of 9.9.
What is the affected software of CVE-2019-10940?
The affected software of CVE-2019-10940 is Siemens SINEMA Server versions < V14.0 SP2 Update 1.
What is the vulnerability type of CVE-2019-10940?
The vulnerability type of CVE-2019-10940 is incorrect session validation.
How can an attacker exploit CVE-2019-10940?
An attacker with a valid session, with low privileges, can exploit CVE-2019-10940 by performing firmware updates and other administrative operations on connected devices.
Are there any references for CVE-2019-10940?
Yes, you can find more information about CVE-2019-10940 in the following references: [Siemens Security Advisory](https://cert-portal.siemens.com/productcert/pdf/ssa-880233.pdf) and [US-CERT Advisory](https://www.us-cert.gov/ics/advisories/icsa-20-014-02).
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/type
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/siemens
- canonical/siemens sinema server
- version/siemens sinema server/14.0
- version/siemens sinema server/14.0-sp1
- version/siemens sinema server/14.0-sp2