CVE-2020-25245

7.8HIGH

Key Information:

Vendor
Siemens
Status
Digsi 4
Vendor
CVE Published:
9 February 2021

Summary

A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM.

Affected Version(s)

DIGSI 4 All versions < V4.94 SP1 HF 1

References

https://cert-portal.siemens.com/productcert/pdf/ssa-53631...
x_refsource_MISC
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.