SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)
The products listed below contain a local privilege escalation vulnerability (CVE-2021-4034) found on polkit's pkexec utility, that could allow an unprivileged user to gain administrative rights. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-4034US | high7.8OT critical | KEV | ||
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pri… | ||||
references
External citations — patches, advisories, analysis.
- SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) - CSAF Versionself
- SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) - PDF Versionself
- SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) - TXT Versionself
remediations (4)
- MitigationSCALANCE LPE9403
Restrict system access to authorized personnel and follow a least privilege approach
- MitigationSINUMERIK Edge
Restrict system access to authorized personnel and follow a least privilege approach
- FixedSCALANCE LPE9403
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811123/ - FixedSINUMERIK Edge
Update to V3.3.0 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan