A vulnerability was found in Siemens SINEMA Remote Connect Server up to 2.0. It has been classified as critical. Affected is an unknown part of the component Web Interface. The manipulation with an unknown input leads to a weak password vulnerability. CWE is classifying the issue as CWE-521. The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing attacks. The vulnerability could be exploited by an attacker with network access to the vulnerable software, requiring no privileges and no user interaction. The vulnerability could allow full access to the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known.

The weakness was shared 09/13/2019. This vulnerability is traded as CVE-2019-13918 since 07/18/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

Applying the patch 2.0 SP1 is able to eliminate this problem.

The entries 141777, 141776 and 141775 are related to this item.

Productinfo

Vendor

• Siemens

Name

• SINEMA Remote Connect Server

Version

• 2.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion