Local Code Execution Vulnerability in SINUMERIK Products by Siemens

CVE-2018-11460

Summary

A vulnerability exists in various SINUMERIK product versions that allows a local attacker with elevated user privileges to modify a CRAMFS archive. This alteration enables the execution of attacker-controlled code with root privileges upon system reboot. The threat is particularly concerning as it can compromise the confidentiality, integrity, and availability of the system. Successful exploitation does not require user interaction, making it critical for local security controls to be robust. As of the advisory's release, there have been no reported cases of public exploitation.

References