Local Code Execution Vulnerability in SINUMERIK Systems by Siemens

CVE-2018-11459

Summary

A local code execution vulnerability exists in various SINUMERIK systems from Siemens that allows an attacker with local access to modify a user-writable configuration file. Upon system reboot or manual initiation, the modified configuration file executes attacker-controlled code with elevated privileges. This exploitation could lead to risks concerning the confidentiality, integrity, and availability of the system. At the time of the advisory release, there was no public evidence of successful exploitation.

References