SINEMA Remote Connect CVE-2025-40819

Exploitation requires direct write access to the product's backend database - specifically the ability to modify the system_ticketinfo table on a SINEMA Remote Connect Server running a version below V3.2 SP4. The flaw is that the application fails to re-validate license restrictions against the database, so tampered rows are trusted. Limiting factors: the attacker must already possess database-level access (a privileged position not available to an ordinary unauthenticated network user), the impact is confined to licensing/entitlement bypass with no confidentiality or availability effect, and it is fixed in V3.2 SP4. This substantially narrows realistic risk despite the network AV rating.

This is a low-priority, low-real-risk issue despite its network-vector CVSS. Siemens scored it 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning low-privileged access, no user interaction, and limited integrity-only impact (C:N/I:L/A:N). The EPSS score is very low at 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit code was identified - all signals point to no meaningful active-exploitation pressure. There is a notable tension between the CVSS vector and the description: Siemens rates AV:N/PR:L, but the description explicitly states the attack requires 'database access' to 'directly modify database values' in the system_ticketinfo table, which is a privileged, backend data-tier position rather than a straightforward remote low-privileged action - this discrepancy should be verified with the vendor, as it suggests the real attack surface is narrower (and the effective privilege requirement higher) than AV:N/PR:L implies. The impact is also purely business/licensing (circumventing license limits), not confidentiality or availability, so this is better characterized as a compliance/abuse-of-functionality flaw than a security-critical breach.

An actor who already holds database-level access to a SINEMA Remote Connect Server (prior to V3.2 SP4) directly edits the system_ticketinfo table, altering license-enforcement values. Because the application does not re-validate license restrictions against the database, the tampered values let the actor use the product beyond its licensed scope. No public exploit code exists, and the attack presupposes existing access to the underlying database.