CVE-2024-41171

State: Published
Severity: 9.3 Critical
Published: Sep 10, 2024
Updated: Sep 10, 2024
Reserved: Jul 17, 2024

Description

A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	siemens
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
SINUMERIK 828D V4Siemens	all versionsAffected
SINUMERIK 828D V5Siemens	before V5.24Affected
SINUMERIK 840D sl V4Siemens	all versionsAffected
SINUMERIK ONESiemens	before V6.24Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-342438.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.