SINUMERIK Devices Vulnerable to Privilege Escalation Attacks

CVE-2024-41171

Summary

A vulnerability has been identified in various Siemens SINUMERIK products where access restrictions to scripts executed with elevated privileges are not properly enforced. This flaw affects devices including SINUMERIK 828D, SINUMERIK 840D sl, and SINUMERIK ONE, allowing an authenticated local attacker to escalate privileges, potentially leading to unauthorized control over the system. The issue exists across all versions of SINUMERIK 828D V4 and 840D sl V4, as well as versions of SINUMERIK ONE prior to V6.24, thus posing risks to operational integrity. For more information, visit the official Siemens CERT portal.

References