var-201904-0175
Vulnerability from variot
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability. SINEMA Remote Connect Server Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Siemens is a leading global technology company that provides solutions to customers in the areas of power generation and transmission and distribution, infrastructure, industrial automation, drive and software with innovation in electrification, automation and digital. Siemens SINEMA has an unauthorized access vulnerability that an attacker can use to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. An attacker could use the vulnerability to compromise confidentiality, integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. The platform supports efficient and secure remote access to machines and equipment distributed around the world, as well as secure management of VPN tunnels between control centers, service engineers and installed equipment. The vulnerability stems from the lack of effective permissions and access control measures in network systems or products
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201904-0175", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "sinema remote connect server", "scope": "lt", "trust": 1.8, "vendor": "siemens", "version": "2.0" }, { "model": "sinema remote connect server", "scope": "lt", "trust": 0.6, "vendor": "siemens", "version": "1.2" }, { "model": "sinema remote connect server", "scope": "eq", "trust": 0.3, "vendor": "siemens", "version": "1.2" }, { "model": "sinema remote connect server", "scope": "ne", "trust": 0.3, "vendor": "siemens", "version": "2.0" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "sinema remote connect server", "version": "*" } ], "sources": [ { "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "db": "CNVD", "id": "CNVD-2019-10133" }, { "db": "BID", "id": "107843" }, { "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "db": "NVD", "id": "CVE-2019-6570" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "2.0", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2019-6570" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Siemens ProductCERT reported these vulnerabilities to NCCIC.,Siemens", "sources": [ { "db": "CNNVD", "id": "CNNVD-201904-466" } ], "trust": 0.6 }, "cve": "CVE-2019-6570", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "NVD", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 8.0, "impactScore": 10.0, "integrityImpact": "COMPLETE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "Single", "author": "NVD", "availabilityImpact": "Complete", "baseScore": 9.0, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "CVE-2019-6570", "impactScore": null, "integrityImpact": "Complete", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.9, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "PARTIAL", "baseScore": 9.7, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "CNVD-2019-10133", "impactScore": 9.5, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "IVD", "availabilityImpact": "PARTIAL", "baseScore": 9.7, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46", "impactScore": 9.5, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.2, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:P", "version": "2.9 [IVD]" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 8.0, "id": "VHN-158005", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 8.8, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2019-6570", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "Low", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2019-6570", "trust": 1.8, "value": "HIGH" }, { "author": "CNVD", "id": "CNVD-2019-10133", "trust": 0.6, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-201904-466", "trust": 0.6, "value": "HIGH" }, { "author": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46", "trust": 0.2, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-158005", "trust": 0.1, "value": "HIGH" }, { "author": "VULMON", "id": "CVE-2019-6570", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "db": "CNVD", "id": "CNVD-2019-10133" }, { "db": "VULHUB", "id": "VHN-158005" }, { "db": "VULMON", "id": "CVE-2019-6570" }, { "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "db": "NVD", "id": "CVE-2019-6570" }, { "db": "CNNVD", "id": "CNNVD-201904-466" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability. SINEMA Remote Connect Server Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Siemens is a leading global technology company that provides solutions to customers in the areas of power generation and transmission and distribution, infrastructure, industrial automation, drive and software with innovation in electrification, automation and digital. Siemens SINEMA has an unauthorized access vulnerability that an attacker can use to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. An attacker could use the vulnerability to compromise confidentiality, integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. The platform supports efficient and secure remote access to machines and equipment distributed around the world, as well as secure management of VPN tunnels between control centers, service engineers and installed equipment. The vulnerability stems from the lack of effective permissions and access control measures in network systems or products", "sources": [ { "db": "NVD", "id": "CVE-2019-6570" }, { "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "db": "CNVD", "id": "CNVD-2019-10133" }, { "db": "BID", "id": "107843" }, { "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "db": "VULHUB", "id": "VHN-158005" }, { "db": "VULMON", "id": "CVE-2019-6570" } ], "trust": 2.79 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2019-6570", "trust": 3.7 }, { "db": "SIEMENS", "id": "SSA-436177", "trust": 2.7 }, { "db": "ICS CERT", "id": "ICSA-19-099-04", "trust": 1.8 }, { "db": "BID", "id": "107843", "trust": 1.7 }, { "db": "CNNVD", "id": "CNNVD-201904-466", "trust": 0.9 }, { "db": "CNVD", "id": "CNVD-2019-10133", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2019-003470", "trust": 0.8 }, { "db": "AUSCERT", "id": "ESB-2019.1221", "trust": 0.6 }, { "db": "IVD", "id": "7372E208-26D9-4CFC-93CD-B8E76B594C46", "trust": 0.2 }, { "db": "VULHUB", "id": "VHN-158005", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2019-6570", "trust": 0.1 } ], "sources": [ { "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "db": "CNVD", "id": "CNVD-2019-10133" }, { "db": "VULHUB", "id": "VHN-158005" }, { "db": "VULMON", "id": "CVE-2019-6570" }, { "db": "BID", "id": "107843" }, { "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "db": "NVD", "id": "CVE-2019-6570" }, { "db": "CNNVD", "id": "CNNVD-201904-466" } ] }, "id": "VAR-201904-0175", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "db": "CNVD", "id": "CNVD-2019-10133" }, { "db": "VULHUB", "id": "VHN-158005" } ], "trust": 0.09 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "ICS" ], "sub_category": null, "trust": 0.8 } ], "sources": [ { "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "db": "CNVD", "id": "CNVD-2019-10133" } ] }, "last_update_date": "2023-12-18T10:47:00.231000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "SSA-436177", "trust": 0.8, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf" }, { "title": "Siemens SINEMA Unauthorized Access Vulnerability Patch", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/158809" }, { "title": "Haxx libcurl Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=91294" }, { "title": "Siemens Security Advisories: Siemens Security Advisory", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=8a056bd2177d12192b11798b7ac3e013" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2019-10133" }, { "db": "VULMON", "id": "CVE-2019-6570" }, { "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "db": "CNNVD", "id": "CNNVD-201904-466" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-280", "trust": 1.0 }, { "problemtype": "CWE-264", "trust": 0.9 }, { "problemtype": "CWE-863", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-158005" }, { "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "db": "NVD", "id": "CVE-2019-6570" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.7, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6570" }, { "trust": 1.0, "url": "https://ics-cert.us-cert.gov/advisories/icsa-19-099-04" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6570" }, { "trust": 0.8, "url": "https://www.us-cert.gov/ics/advisories/icsa-19-099-04" }, { "trust": 0.7, "url": "https://www.securityfocus.com/bid/107843" }, { "trust": 0.6, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-19-099-04" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/78786" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/280.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2019-10133" }, { "db": "VULHUB", "id": "VHN-158005" }, { "db": "VULMON", "id": "CVE-2019-6570" }, { "db": "BID", "id": "107843" }, { "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "db": "NVD", "id": "CVE-2019-6570" }, { "db": "CNNVD", "id": "CNNVD-201904-466" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "db": "CNVD", "id": "CNVD-2019-10133" }, { "db": "VULHUB", "id": "VHN-158005" }, { "db": "VULMON", "id": "CVE-2019-6570" }, { "db": "BID", "id": "107843" }, { "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "db": "NVD", "id": "CVE-2019-6570" }, { "db": "CNNVD", "id": "CNNVD-201904-466" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-04-17T00:00:00", "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "date": "2019-04-17T00:00:00", "db": "CNVD", "id": "CNVD-2019-10133" }, { "date": "2019-04-17T00:00:00", "db": "VULHUB", "id": "VHN-158005" }, { "date": "2019-04-17T00:00:00", "db": "VULMON", "id": "CVE-2019-6570" }, { "date": "2019-04-09T00:00:00", "db": "BID", "id": "107843" }, { "date": "2019-05-17T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "date": "2019-04-17T14:29:03.730000", "db": "NVD", "id": "CVE-2019-6570" }, { "date": "2019-04-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201904-466" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-04-17T00:00:00", "db": "CNVD", "id": "CNVD-2019-10133" }, { "date": "2020-10-06T00:00:00", "db": "VULHUB", "id": "VHN-158005" }, { "date": "2021-03-15T00:00:00", "db": "VULMON", "id": "CVE-2019-6570" }, { "date": "2019-04-09T00:00:00", "db": "BID", "id": "107843" }, { "date": "2019-07-08T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-003470" }, { "date": "2021-03-15T18:15:16.457000", "db": "NVD", "id": "CVE-2019-6570" }, { "date": "2021-03-19T00:00:00", "db": "CNNVD", "id": "CNNVD-201904-466" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201904-466" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Siemens SINEMA Unauthorized Access Vulnerability", "sources": [ { "db": "IVD", "id": "7372e208-26d9-4cfc-93cd-b8e76b594c46" }, { "db": "CNVD", "id": "CNVD-2019-10133" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "permissions and access control issues", "sources": [ { "db": "CNNVD", "id": "CNNVD-201904-466" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.