#VU56658 Modification of assumed-immutable data in SINEMA Remote Connect Server - CVE-2021-37177

Vulnerability identifier: #VU56658

Vulnerability risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-37177

CWE-ID: CWE-471

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
SINEMA Remote Connect Server
Server applications / SCADA systems

Vendor: Siemens

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to application does not perform validation of the attacker-controlled data, assuming that data is valid and safe. A remote attacker on the local network can manipulate with the status provided by the syslog clients managed by the affected software.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

SINEMA Remote Connect Server: before 3.0

---

External links
https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.