CVE-2025-40818

LowCVSS 3.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

A vulnerability in SINEMA Remote Connect Server (all versions < V3.2 SP4) allows any user with server access to read private SSL/TLS keys that are not properly protected. This could allow an authenticated attacker to impersonate the server, potentially enabling man-in-the-middle, traffic decryption, or unauthorized access to services that trust these certificates.

Risk Assessment

Risk of server impersonation, traffic interception and decryption, and unauthorized access to services, potentially leading to severe security breaches.

Recommendation

Update SINEMA Remote Connect Server to V3.2 SP4 or later and secure server access and private keys.

Other vulnerabilities in SINEMA Remote Connect Server

CVE-2025-40819Medium
In SINEMA Remote Connect Server (versions < V3.2 SP4), the application does not properly validate license restrictions against the database, allowing direct modification of the system_ticketinfo table to bypass license limitations without proper enforcement checks. Someone with database access could circumvent licensing restrictions by directly modifying database values and potentially enabling unauthorized use beyond the permitted scope.

Original NVD description (English source)

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS