Privilege escalation in SINEMA Remote Connect Client
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2021-31338 |
| CWE-ID | CWE-20 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
SINEMA Remote Connect Client Server applications / Other server solutions |
| Vendor |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Input validation error
EUVDB-ID: #VU55996
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-31338
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the affected devices allow to modify configuration settings over an unauthenticated channel. A local user can escalate privileges and execute arbitrary code on the device.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSINEMA Remote Connect Client: before V3.0 SP1
CPE2.3http://cert-portal.siemens.com/productcert/pdf/ssa-816035.pdf
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
