A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application does not expire the user session on reboot without logout. This could allow an attacker to bypass Multi-Factor Authentication.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sinema_remote_connect_client | Siemens | * | 3.2 (excluding) |
| Sinema_remote_connect_client | Siemens | 3.2 (including) | 3.2 (including) |
| Sinema_remote_connect_client | Siemens | 3.2-sp1 (including) | 3.2-sp1 (including) |