SSA-835377: Missing Authentication Vulnerability in SINEMA Server
The latest update for SINEMA Server fixes a vulnerability that could allow an unauthenticated attacker to obtain encoded system configuration backup files under certain conditions. Siemens has released an update for the SINEMA Server and recommends to update to the latest version.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-10941US | medium5.3OT erhöht | — | ||
A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires administrative user identity could allow an at… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (3)
- MitigationSINEMA Server
Monitor and restrict network access to device port 443/tcp and 80/tcp to trusted IP addresses
- BehobenSINEMA Server
Update to V14 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109801374/ - WorkaroundSINEMA Server
Consider adding to your monitoring capabilities an allowed time window for system configuration backup download. This will be an auxiliar to create a baseline and monitor for abnormal behavior
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan