Siemens SINEC Security Monitor Improper Authorization Vulnerability in File Transfer Feature

A vulnerability exists in Siemens SINEC Security Monitor versions prior to 4.10.0. The issue arises from inadequate authorization checks in the file transfer feature of the ssmctl-client command. This flaw could enable an authenticated, low-privileged local attacker to read from or write to any file on the server or sensor.

Impact

Exploitation of this vulnerability could lead to unauthorized file access or modification on the server or sensor.

Remediation

Users are advised to update SINEC Security Monitor to version 4.10.0 or later. Additional guidance can be found on the Siemens support website.