Vulnerability in Siemens Sinumerik 828d V4
CVE-2024-41171
A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system.
EPSS: 0.001 (3.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Siemens Sinumerik 828d V4 — versions 0
- Siemens Sinumerik 828d V5 — versions 0
- Siemens Sinumerik 840d Sl V4 — versions 0
- Siemens Sinumerik One — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-41171?
- CVE-2024-41171 is a high-severity vulnerability in Siemens Sinumerik 828d V4, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 8.8/10. Published 2024-09-10.
- How severe is CVE-2024-41171?
- High severity. CVSS v3 base score is 8.8 out of 10.