CVE-2024-39866
First published: Tue Jul 09 2024(Updated: )
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. This could allow an attacker with access to the backup encryption key and with the right to upload backup files to create a user with administrative privileges.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens SINEMA Remote Connect | <3.2 | |
| Siemens SINEMA Remote Connect | =3.2 | |
| Siemens SINEMA Remote Connect | =3.2-hf1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-39866?
CVE-2024-39866 is considered a high severity vulnerability due to its potential to allow unauthorized user creation through uploaded backup files.
How do I fix CVE-2024-39866?
To mitigate CVE-2024-39866, upgrade to SINEMA Remote Connect Server version 3.2 SP1 or later.
Who is affected by CVE-2024-39866?
CVE-2024-39866 affects all versions of SINEMA Remote Connect Server prior to 3.2 SP1.
What does CVE-2024-39866 allow an attacker to do?
CVE-2024-39866 allows an attacker with access to the backup encryption key to create unauthorized users by uploading manipulated backup files.
Is there a workaround for CVE-2024-39866?
There are no official workarounds for CVE-2024-39866; upgrading to a patched version is recommended.
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens sinema remote connect
- version/siemens sinema remote connect/3.2
- version/siemens sinema remote connect/3.2-hf1