Description
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to command injection due to missing server side input sanitation when loading VPN configurations. This could allow an administrative remote attacker running a corresponding SINEMA Remote Connect Server to execute arbitrary code with system privileges on the client system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SINEMA Remote Connect Client | < V3.2 HF1 | V3.2 HF1 |
Advisories 3
- NCSC-2024-0282 Kwetsbaarheden verholpen in Siemens Producten NCSC-NL (Netherlands) · Jul 9, 2024
- ICSA-24-193-15 Siemens SINEMA Remote Connect Server CISA ICS & IT advisories · Jul 9, 2024
- SSA-868282 SSA-868282: Multiple Vulnerabilities in SINEMA Remote Connect Client before V3.2 HF1 Siemens ProductCERT · Jul 9, 2024