Cyber Resilience

CVE-2024-39870

Siemens Sinema Remote Connect Server ≤ 3.2

Published
09 July 2024
Modified
21 November 2024
Patch / advisory
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0025 16th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2024-39870 is a high-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability in Siemens Sinema Remote Connect Server. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured to allow users to manage own users. A local authenticated user with this privilege could use this modify users…

more

outside of their own scope as well as to escalate privileges.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-39867Same product: Siemens Sinema Remote Connect Server
CVE-2024-39868Same product: Siemens Sinema Remote Connect Server
CVE-2024-39865Same product: Siemens Sinema Remote Connect Server
CVE-2024-39871Same product: Siemens Sinema Remote Connect Server
CVE-2025-40819Same product: Siemens Sinema Remote Connect Server
CVE-2024-39571Same product: Siemens Sinema Remote Connect Server
CVE-2024-39570Same product: Siemens Sinema Remote Connect Server
CVE-2024-42345Same product: Siemens Sinema Remote Connect Server
CVE-2024-39872Same product: Siemens Sinema Remote Connect Server
CVE-2024-39874Same product: Siemens Sinema Remote Connect Server

Affected Assets

siemens
sinema remote connect server
3.2 · ≤ 3.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V10.7.1
  • V2.2.2
  • V8.3.1
  • V10.4.1

Mitigating Controls (NIST 800-53 r5) AI

Requires a tamper-proof, always-invoked reference monitor that cannot be bypassed by client-side logic.

Enforces all access decisions on the server according to policy rather than trusting client-supplied enforcement.

Enforces information-flow rules at the server boundary instead of delegating them to the client.

Monitors and controls all external and key internal interfaces so that server-side policy cannot be off-loaded to clients.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent design flaws that place server security enforcement on the client.

PR.AA-05 partial match
prevents

Proper policy-based enforcement of authorizations implies server-side controls rather than client-only checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure architecture principles discourage client-side trust but do not directly address this weakness.

finds

Security testing can detect client-side enforcement but is not the primary mitigation.

prevents

Information access restriction is undermined when the client is trusted to enforce it.

prevents

Secure development lifecycle mandates server-side validation and prevents reliance on client enforcement.

prevents

Application security requirements explicitly call for server-side enforcement of security mechanisms.

prevents

Secure coding standards require server-side checks and reject client-only enforcement.

References