VDB
ICSA-24-256-02
ICSA-24-256-02
PUBLISHED
CVSS 8.800000190734863 HIGH
SINUMERIK ONE, SINUMERIK 840D sl and SINUMERIK 828D are affected by a privilege escalation vulnerability that could allow an authenticated local attacker to escalate their privileges in the underlying system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.
Risk Scores
CVSS v3.1
8.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| SINUMERIK ONE | ||
| SINUMERIK 828D V5 | ||
| SINUMERIK 828D V4 | ||
| SINUMERIK 840D sl V4 |
Timeline
- Sep 10, 2024 CVE Published
- May 6, 2025 CVE Updated
References
- https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B url
- https://cert-portal.siemens.com/productcert/csaf/ssa-342438.json advisory
- https://cert-portal.siemens.com/productcert/html/ssa-342438.html advisory
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-256-02.json advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-02 advisory
- https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 url
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices url
- https://www.cisa.gov/topics/industrial-control-systems url
- https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf url
- https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf url