Paper/Archive/CVE-2022-32257

CVE-2022-32257

Siemens SINEMA Remote Connect Server — A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2).

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 57.9.579 × 2011.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to resources and potentially lead to code execution.

Affected

ProductAffectedFixed inSource

SINEMA Remote Connect Server< V3.2V3.2CNA

sinema_remote_connect_server< 3.23.2CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

siemens (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert-portal.siemens.com/productcert/html/ssa-576771.html