CVE-2022-24408

2022-03-0811:31:30

CWE-269

siemens

www.cve.org

sinumerik mc

sinumerik one

vulnerability

escalate privileges

local attackers

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify system files. A specific set of operations using sc could allow local attackers to escalate their privileges to root.

CNA Affected

[
  {
    "product": "SINUMERIK MC",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V1.15 SP1"
      }
    ]
  },
  {
    "product": "SINUMERIK ONE",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V6.15 SP1"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-337210.pdf