cve.bz

CVE-2024-39872

9.3 criticalEPSS 0.5%

Critical (9.3) in siemens sinema remote connect server. EPSS 0.5% chance of exploitation in the next 30 days.

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'Manage firmware updates' role to escalate their privileges on the underlying OS level.

Severity

CVSS 4.0

9.3 critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H

CVSS 3.1

9.9 critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS
0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE
CWE-378
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON