CVE-2019-10940
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid session, with low privileges, to perform firmware updates and other administrative operations on connected devices. The security vulnerability could be exploited by an attacker with network access to the affected system. An attacker must have access to a low privileged account in order to exploit the vulnerability. An attacker could use the vulnerability to compromise confidentiality, integrity, and availability of the affected system and underlying components. At the time of advisory publication no public exploitation of this security vulnerability was known.
Se ha identificado una vulnerabilidad en SINEMA Server (Todas las versiones anteriores a V14.0 SP2 Update 1). Una comprobación de sesión incorrecta podría permitir a un atacante con una sesión válida, con pocos privilegios, llevar a cabo actualizaciones de firmware y otras operaciones administrativas en los dispositivos conectados. La vulnerabilidad de seguridad podría ser explotada por un atacante con acceso de red al sistema afectado. Un atacante necesita tener acceso a una cuenta poco privilegiada a fin de explotar la vulnerabilidad. Un atacante podría usar la vulnerabilidad para comprometer la confidencialidad, integridad y disponibilidad del sistema afectado y los componentes subyacentes. Al momento de la publicación del aviso, no se conocía una explotación pública de esta vulnerabilidad de seguridad.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-04-08 CVE Reserved
- 2020-01-16 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-266: Incorrect Privilege Assignment
- CWE-269: Improper Privilege Management
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.us-cert.gov/ics/advisories/icsa-20-014-02 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-880233.pdf | 2021-09-20 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Siemens Search vendor "Siemens" | Sinema Server Search vendor "Siemens" for product "Sinema Server" | < 14.0 Search vendor "Siemens" for product "Sinema Server" and version " < 14.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinema Server Search vendor "Siemens" for product "Sinema Server" | 14.0 Search vendor "Siemens" for product "Sinema Server" and version "14.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinema Server Search vendor "Siemens" for product "Sinema Server" | 14.0 Search vendor "Siemens" for product "Sinema Server" and version "14.0" | sp1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinema Server Search vendor "Siemens" for product "Sinema Server" | 14.0 Search vendor "Siemens" for product "Sinema Server" and version "14.0" | sp2 |
Affected
| ||||||