Local Command Injection Flaw in Siemens SIMATIC RTLS Locating Manager

CVE-2020-10051

What is CVE-2020-10051?

A local command injection vulnerability has been identified in the Siemens SIMATIC RTLS Locating Manager. This issue arises due to multiple services running with SYSTEM privileges, and the absence of properly quoted call paths. As a result, a local attacker is able to inject arbitrary commands that can be executed in place of the legitimate service, potentially compromising the security of the system.

References