CVE-2025-40819

MediumCVSS 4.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

In SINEMA Remote Connect Server (versions < V3.2 SP4), the application does not properly validate license restrictions against the database, allowing direct modification of the system_ticketinfo table to bypass license limitations without proper enforcement checks. Someone with database access could circumvent licensing restrictions by directly modifying database values and potentially enabling unauthorized use beyond the permitted scope.

Risk Assessment

An attacker with database access could bypass licensing restrictions and use the system beyond the permitted scope, potentially leading to unauthorized access and license violations.

Recommendation

Update SINEMA Remote Connect Server to version V3.2 SP4 or later and restrict database access to the minimum necessary.

Other vulnerabilities in SINEMA Remote Connect Server

CVE-2025-40818Low
A vulnerability in SINEMA Remote Connect Server (all versions < V3.2 SP4) allows any user with server access to read private SSL/TLS keys that are not properly protected. This could allow an authenticated attacker to impersonate the server, potentially enabling man-in-the-middle, traffic decryption, or unauthorized access to services that trust these certificates.

Original NVD description (English source)

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do not properly validate license restrictions against the database, allowing direct modification of the system_ticketinfo table to bypass license limitations without proper enforcement checks. This could allow with database access to circumvent licensing restrictions by directly modifying database values and potentially enabling unauthorized use beyond the permitted scope.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS