CVE-2024-39865
Published: 09 July 2024
Summary
CVE-2024-39865 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Siemens Sinema Remote Connect Server. Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2024-39865 affects Siemens SINEMA Remote Connect Server in all versions prior to V3.2 SP1. It arises from insufficient path validation when restoring files from user-uploaded encrypted backups, enabling unrestricted upload of arbitrary file types as classified under CWE-434.
An authenticated attacker who possesses the backup encryption key can supply a malicious archive that restores files to arbitrary locations on the server. Successful exploitation can result in remote code execution with impacts on confidentiality, integrity, and availability.
The Siemens advisory at https://cert-portal.siemens.com/productcert/html/ssa-381581.html addresses the issue and directs users to apply the fixed release V3.2 SP1. The associated EPSS score has remained flat at 0.1055 with no indicated rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38270
Vulnerability details
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. As part of this backup, files can be restored without correctly checking the path of…
more
the restored file. This could allow an attacker with access to the backup encryption key to upload malicious files, that could potentially lead to remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.