-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-816035: Code Execution Vulnerability in SINEMA Remote Connect Client

Publication Date:        2021-08-19
Last Update:             2021-08-19
Current Version:         1.0
CVSS v3.1 Base Score:    7.8

SUMMARY
=======

The latest update for SINEMA Remote Connect Client fixes a vulnerability
that could allow a local attacker to escalate privileges or even allow
remote code execution under certain circumstances.

Siemens has released a firmware update for SINEMA Remote Connect Client
and proposes mitigations if an update is not possible.


AFFECTED PRODUCTS AND SOLUTION
==============================


* SINEMA Remote Connect Client 
  - Affected versions:
       All versions < V3.0 SP1
  - Remediation:
       Update to V3.0 SP1 or later version
  - Download:
       https://support.industry.siemens.com/cs/de/en/view/109793790/


WORKAROUNDS AND MITIGATIONS
===========================

Siemens has identified the following specific workarounds and mitigations that
customers can apply to reduce the risk:

* Do not access links from untrusted sources

* Restrict access to hosts running SINEMA Remote Connect Client to trusted
personnel



GENERAL SECURITY RECOMMENDATIONS
================================

As a general security measure, Siemens strongly recommends to protect
network access to devices with appropriate mechanisms. In order to
operate the devices in a protected IT environment, Siemens recommends to
configure the environment according to Siemens' operational guidelines
for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security),
and to follow the recommendations in the product manuals.

Additional information on Industrial Security by Siemens can be found
at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION
===================

SINEMA Remote Connect is a management platform for remote networks that
enables the simple management of tunnel connections (VPN) between
headquarters, service technicians, and installed machines or plants. It
provides both the Remote Connect Server, which is the server
application, and the Remote Connect Client, which is an OpenVPN client
for optimal connection to SINEMA Remote Connect Server.

VULNERABILITY CLASSIFICATION
============================

The vulnerability classification has been performed by using the CVSS scoring
system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS
environmental score is specific to the customer's environment and will impact
the overall CVSS score. The environmental score should therefore be
individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a
community-developed list of common software security weaknesses. This serves as
a common language and as a baseline for weakness identification, mitigation,
and prevention efforts. A detailed list of CWE classes can be found at:
https://cwe.mitre.org/.



* Vulnerability CVE-2021-31338

  Affected devices allow to modify configuration settings over an
  unauthenticated channel.
  
  This could allow a local attacker to escalate privileges and execute own
  code on the device.

  CVSS v3.1 Base Score: 7.8
  CVSS Vector:          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-15: External Control of System or Configuration Setting


ACKNOWLEDGMENTS
===============

Siemens thanks the following parties for their efforts:

   * Amir Preminger from Claroty for coordinated disclosure



ADDITIONAL INFORMATION
======================

For further inquiries on security vulnerabilities in Siemens products and
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2021-08-19): Publication Date

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElTRCLAVwzKf/b8X80/SB6hFKr+QFAmEdnwAACgkQ0/SB6hFK
r+T6WQ//b2zMxy4a53DltbevOzFr9JxnjU4GQVOHiy6kAZb3mtn46Jo2W8pgvgdW
FTHL4cgtRkYh0AVnWFWg2mQts3qUmr5V2Wel4/J3Vj2j8RgqrdkyvpUg/DCW5l9v
mw00i9kxdDyQDvkJj1sbYGK9gxB/KvUGlvmdIjaok9nFksXwhi3/Julfp1Oo9pGE
+x7U/VxSYxfY5YGhUPMhoQ65DwQaKqxu60HD2Q1TxQ7K+gSJdrn1BaZIu/56HUKv
NFoVq8pNMO8JjLMuPbpGa6ZssNLnxvGvz/VDQ2A/GSsVylWY22djnI6C1WUG6brc
4g06GL0hztOkcXM8ArXLDtilbsEW1P/GETz64kdLXv6bcnNLsyjYTzKJC0fEgSoZ
h0+eghI+brawgE5Z9F8srDgFetaYqcSqCYEGP5bmqJD9IOsiE6OTVG9Kxv4w8P2M
SAQT2Zu9FT+meDZkMUBsHs3X/ggDQ2sw8pwQBO4QJ3IYyWPFJWBz26P8ZlXZCzJ+
2Tm1GFH8s54T5j8kibaKftAZloWmqkEm/q/Uzc3xTVXQA2kIRLmyIeP7ck0ogRIF
Wro4ZIqdfdpMMMMd58xTZ7cKH4Te4SKEDmu0Ry4rHMEBLzwsGHAXFCzA/DaHfsYA
9xWNW3oDgUpsWcMqleAk9T1aSjxb7Zg8JX74mVwhjg1O2WagwXk=
=0IED
-----END PGP SIGNATURE-----