SINUMERIK Devices Vulnerable to Privilege Escalation Attacks

CVE-2024-41171

8.8HIGH

Key Information

Vendor
Siemens
Status
Sinumerik 828d V4
Sinumerik 828d V5
Sinumerik 840d Sl V4
Sinumerik One
Vendor
CVE Published:
10 September 2024

Summary

A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system.

Affected Version(s)

SINUMERIK 828D V4 < 0

SINUMERIK 828D V5 < 0

SINUMERIK 840D sl V4 < 0

Refferences

https://cert-portal.siemens.com/productcert/html/ssa-3424...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.