CVE-2025-40819: siemens sinema_remote_connect_server Incorrect Authorization

Vulnerability summary

CVE-2025-40819 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in siemens sinema_remote_connect_server. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.2% of scored vulnerabilities.

Timeline

1. 09-12-2025
   PublishedVulnerability first disclosed.
2. 09-12-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do not properly validate license restrictions against the database, allowing direct modification of the system_ticketinfo table to bypass license limitations without proper enforcement checks. This could allow with database access to circumvent licensing restrictions by directly modifying database values and potentially enabling unauthorized use beyond the permitted scope.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.