Siemens SINEMA Remote Connect Server License Bypass Vulnerability

A vulnerability exists in Siemens SINEMA Remote Connect Server in all versions prior to V3.2 SP4. The issue arises because affected applications fail to properly validate license restrictions against the database. This flaw allows direct modification of the system_ticketinfo table, enabling users with database access to bypass license limitations. As a result, unauthorized use beyond the permitted scope could be facilitated by altering database values without appropriate enforcement checks.

Impact

Exploitation of this vulnerability could lead to unauthorized use of the application beyond licensed limits, by allowing users to manipulate database values related to license restrictions.

Remediation

Users are advised to update SINEMA Remote Connect Server to V3.2 SP4 or a later version. Additional guidance can be found on the Siemens Industry Support website.