Our takeSiemens published an advisory for a privilege-escalation flaw in multiple SIMATIC WinCC versions that lets an authenticated database user run commands on the host. Update to the fixed releases.Security Resilience desk
Sources (1)
- cisa_advisories · cisa_advisories
What this means for you — Security leader:Update affected SIMATIC WinCC versions to the latest releases Siemens has published; the vulnerability lets an authenticated database user escalate privileges and run commands on the host.
What this means for you — Lean IT orgs:If you run Siemens WinCC, update it to the newest version Siemens released — the flaw lets someone with database access run commands on the computer.
What this means for you — MSP:Check every client running SIMATIC WinCC and push the vendor’s latest versions; the database privilege-escalation flaw can let an authenticated user execute commands on the underlying host.
What this means for you — Researcher:Siemens published fixes for a privilege-escalation vulnerability in multiple SIMATIC WinCC versions that lets an authenticated database user execute commands on the host; additional fixes are still in preparation.