Siemens SCALANCE LPE 4903 and SINUMERIK Edge
The products listed below contain a local privilege escalation vulnerability (CVE-2021-4034) found on polkit's pkexec utility, that could allow an unprivileged user to gain administrative rights. Siemens has released updates for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-4034US | high7.8OT kritisch | KEV | ||
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pri… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) - CSAF Versionself
- SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) - PDF Versionself
- SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) - TXT Versionself
- ICS Advisory ICSA-22-167-16 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-167-16 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (4)
- MitigationSCALANCE LPE9403
Restrict system access to authorized personnel and follow a least privilege approach
- MitigationSINUMERIK Edge
Restrict system access to authorized personnel and follow a least privilege approach
- BehobenSCALANCE LPE9403
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811123/ - BehobenSINUMERIK Edge
Update to V3.3.0 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan