Vulnerability in Siemens Sinumerik 828d V4

CVE-2024-41171

A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.001 (2.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 2.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2024-41171: held from 0.001 to 0.001.

EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2024-41171?
CVE-2024-41171 is a high-severity vulnerability in Siemens Sinumerik 828d V4, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 8.8/10. Published 2024-09-10.
How severe is CVE-2024-41171?
High severity. CVSS v3 base score is 8.8 out of 10.