Sinema Remote Connect Server Siemens Sinema Remote Connect Server

Do you want an email whenever new security vulnerabilities are reported in Siemens Sinema Remote Connect Server?

By the Year

In 2022 there have been 16 vulnerabilities in Siemens Sinema Remote Connect Server with an average score of 7.0 out of ten. Last year Sinema Remote Connect Server had 9 security vulnerabilities published. That is, 7 more vulnerabilities have already been reported in 2022 as compared to last year. However, the average CVE base score of the vulnerabilities in 2022 is greater by 0.87.

Year Vulnerabilities Average Score
2022 16 7.01
2021 9 6.14
2020 1 7.50
2019 6 6.23
2018 0 0.00

It may take a day or so for new Sinema Remote Connect Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Siemens Sinema Remote Connect Server Security Vulnerabilities

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32260 9.8 - Critical - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application creates temporary user credentials for UMC (User Management Component) users. An attacker could use these temporary credentials for authentication bypass in certain scenarios.

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32253 7.5 - High - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker.

Improper Input Validation

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32251 9.8 - Critical - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an administrative user.

Missing Authentication for Critical Function

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-27221 5.9 - Medium - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack.

Insufficient Entropy

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32262 9.8 - Critical - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution.

Command Injection

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32259 6.5 - Medium - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The system images for installation or update of the affected application contain unit test scripts with sensitive information. An attacker could gain information about testing architecture and also tamper with test configuration.

AuthZ

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32258 7.5 - High - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure.

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32261 7.5 - High - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application.

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32256 6.5 - Medium - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information.

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32255 5.3 - Medium - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to limited information.

AuthZ

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32254 7.5 - High - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valuable guidance to an attacker.

Insertion of Sensitive Information into Log File

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-32252 7.8 - High - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker.

Insufficient Verification of Data Authenticity

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)

CVE-2022-29034 6.1 - Medium - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting (XSS) attacks.

XSS

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)

CVE-2022-27220 4.3 - Medium - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.

Clickjacking

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)

CVE-2022-27219 4.3 - Medium - June 14, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.

Clickjacking

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0)

CVE-2022-23102 6.1 - Medium - February 09, 2022

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks.

Open Redirect

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries

CVE-2021-41991 7.5 - High - October 18, 2021

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.

Integer Overflow or Wraparound

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)

CVE-2021-37177 6.5 - Medium - September 14, 2021

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by the syslog clients managed by the affected software can be manipulated by an unauthenticated attacker in the same network of the affected system.

MAID

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)

CVE-2021-37183 6.5 - Medium - September 14, 2021

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software allows sending send-to-sleep notifications to the managed devices. An unauthenticated attacker in the same network of the affected system can abuse these notifications to cause a Denial-of-Service condition in the managed devices.

Authorization

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)

CVE-2021-37190 4.3 - Medium - September 14, 2021

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerability that could allow an attacker to retrieve VPN connection for a known user.

Information Disclosure

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)

CVE-2021-37191 4.3 - Medium - September 14, 2021

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could brute force the usernames from the affected software.

Insufficient anti-automation

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)

CVE-2021-37192 4.3 - Medium - September 14, 2021

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerability that could allow an attacker to retrieve a list of network devices a known user can manage.

Information Disclosure

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)

CVE-2021-37193 4.3 - Medium - September 14, 2021

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could manipulate certain parameters and set a valid user of the affected software as invalid (or vice-versa).

MAID

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0)

CVE-2020-25240 8.8 - High - March 15, 2021

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). Unpriviledged users can access services when guessing the url. An attacker could impact availability, integrity and gain information from logs and templates of the service.

AuthZ

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0)

CVE-2020-25239 8.8 - High - March 15, 2021

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). The webserver could allow unauthorized actions via special urls for unpriviledged users. The settings of the UMC authorization server could be changed to add a rogue server by an attacker authenticating with unprivilege user rights.

AuthZ

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

CVE-2020-7595 7.5 - High - January 21, 2020

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Infinite Loop

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

CVE-2019-19956 7.5 - High - December 24, 2019

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

Missing Release of Resource after Effective Lifetime

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1)

CVE-2019-13922 2.7 - Low - September 13, 2019

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with administrative privileges can obtain the hash of a connected device's password. The security vulnerability could be exploited by an attacker with network access to the SINEMA Remote Connect Server and administrative privileges. At the time of advisory publication no public exploitation of this security vulnerability was known.

Missing Encryption of Sensitive Data

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1)

CVE-2019-13920 4.3 - Medium - September 13, 2019

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not protected against Cross Site Request Forgery (CSRF) attacks. The security vulnerability could be exploited by an attacker that is able to trigger requests of a logged-in user to the application. The vulnerability could allow switching the connectivity state of a user or a device. At the time of advisory publication no public exploitation of this security vulnerability was known.

Session Riding

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1)

CVE-2019-13919 4.3 - Medium - September 13, 2019

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by a privileged user can also be accessed by a non-privileged user. The security vulnerability could be exploited by an attacker with network access and valid credentials for the web interface. No user interaction is required. The vulnerability could allow an attacker to access information that he should not be able to read. The affected information does not include passwords. At the time of advisory publication no public exploitation of this security vulnerability was known.

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1)

CVE-2019-13918 9.8 - Critical - September 13, 2019

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing attacks. The vulnerability could be exploited by an attacker with network access to the vulnerable software, requiring no privileges and no user interaction. The vulnerability could allow full access to the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known.

Weak Password Requirements

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0)

CVE-2019-6570 8.8 - High - April 17, 2019

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability.

Improper Handling of Insufficient Permissions or Privileges

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Siemens Sinema Remote Connect Server or by Siemens? Click the Watch button to subscribe.

Siemens
Vendor

subscribe