Summary
The products listed below contain a local privilege escalation vulnerability (CVE-2021-4034) found on polkit's pkexec utility, that could allow an unprivileged user to gain administrative rights.
Siemens has released updates for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
High 7.8
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid too…
KEV Jun 27, 2022
Revision history
-
#1
Publication Date
References
-
SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-330556.txt
-
SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf
-
ICS Advisory ICSA-22-167-16 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-167-16
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B