Improper User Permission Control in Siemens SIMATIC IPC DiagBase and DiagMonitor

CVE-2025-23403

Summary

A critical security vulnerability has been detected in Siemens' SIMATIC IPC DiagBase and DiagMonitor. The affected systems fail to enforce proper permissions for their respective registry keys, which may allow authenticated attackers to exploit this flaw. By gaining unauthorized access, attackers could potentially load malicious drivers into the system. This action can lead to privilege escalation, allowing them to bypass existing endpoint protection and other security measures, thereby compromising system integrity and data security.

References