« Volver al listado

CVE-2022-24408

Estado: ModificadaAlta (7.8)—

A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify system files. A specific set of operations using sc could allow local attackers to escalate their privileges to root.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Siemens — Sinumerik MC FirmwareSiemens — Sinumerik ONE Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-24408",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "SINUMERIK MC",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V1.15 SP1"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SINUMERIK ONE",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V6.15 SP1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-08T12:15:11.627",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-337210.pdf",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-337210.pdf",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify system files. A specific set of operations using sc could allow local attackers to escalate their privileges to root."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en SINUMERIK MC (Todas las versiones anteriores a la versión V1.15 SP1), SINUMERIK ONE (Todas las versiones anteriores a la versión V6.15 SP1). El binario sc SUID en los dispositivos afectados proporciona varios comandos que se utilizan para ejecutar comandos del sistema o modificar archivos del sistema. Un conjunto específico de operaciones utilizando sc podría permitir a los atacantes locales escalar sus privilegios a root"
    }
  ],
  "lastModified": "2026-06-17T04:31:47.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sinumerik_mc_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA3311CC-3C2B-4E9C-B972-2F76BA8694C0",
              "versionEndExcluding": "1.15"
            },
            {
              "criteria": "cpe:2.3:o:siemens:sinumerik_mc_firmware:1.15:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26E27721-C049-49AC-BBF8-F2C0366BB004"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sinumerik_mc:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6A86979B-71A2-49E6-BFBC-E12FBBE60EEA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sinumerik_one_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03215CCE-3A62-4C3B-8D29-22C0DE5CEC0E",
              "versionEndExcluding": "6.15"
            },
            {
              "criteria": "cpe:2.3:o:siemens:sinumerik_one_firmware:6.15:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64F97D32-42DC-4555-A296-E87A73640D77"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sinumerik_one:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AE30FFDF-5494-400D-8F88-954A6B1503B9"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}