Description
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIMATIC RTLS Locating Manager | All versions < V2.10.2 | — |
Advisories 1
- ICSA-20-252-01 Siemens SIMATIC RTLS Locating Manager CISA ICS & IT advisories · Sep 8, 2020