Summary
A vulnerability in Xpedition Designer could allow an attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges.
Siemens has released updates for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
High 7.8
A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designe…
Revision history
-
#3
Revision - Fixing typos
-
#2
Added new fix for versions VX.2.10 and VX.2.11. Added VX.2.12 and VX.2.13 as affected versions
-
#1
Publication Date
References
-
SSA-988345: Local Privilege Escalation Vulnerability in Xpedition Designer - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-988345.html
-
SSA-988345: Local Privilege Escalation Vulnerability in Xpedition Designer - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-988345.pdf
-
SSA-988345: Local Privilege Escalation Vulnerability in Xpedition Designer - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-988345.txt
-
ICS Advisory ICSA-22-167-11 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-167-11
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B