Medium severity · published Sep 10, 2024
CVE-2024-42344
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2)
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application inserts sensitive information into a log file which is readable by all legitimate users of the underlying system. This could allow an authenticated attacker to compromise the confidentiality of other users' configuration data.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SR
SINEMA Remote Connect Client · Siemens
before V3.2 SP2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42344
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42344
Patch
https://cert-portal.siemens.com/productcert/html/ssa-417159.html
More from SINEMA Remote Connect Client
9.8
CVE-2024-33698
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1…
9.8
CVE-2019-3822
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow
8.6
CVE-2024-2398
HTTP/2 push headers memory-leak
7.8
CVE-2024-39568
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1)
7.8
CVE-2024-39567
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1)