Description
A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system.
Scores
CVSS v3
8.8
EPSS
0.0004
EPSS Percentile
13.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-732
Status
published
Products (4)
Siemens/SINUMERIK 828D V4
Siemens/SINUMERIK 828D V5
< V5.24
Siemens/SINUMERIK 840D sl V4
Siemens/SINUMERIK ONE
< V6.24
Published
Sep 10, 2024
Tracked Since
Feb 18, 2026