SINEC Security Monitor Vulnerability - Arbitrary Code Execution

CVE-2024-47553

Summary

A vulnerability exists in the Siemens SINEC Security Monitor prior to version 4.9.0, where the application fails to adequately validate user input processed by the 'ssmctl-client' command. This shortcoming may enable an authenticated, low-privilege remote attacker to execute arbitrary code with elevated privileges, potentially compromising the integrity and security of the underlying operating system. Proper measures should be taken to mitigate this risk by updating to the latest version or applying recommended security practices.

References