Siemens SICAM SIAPP SDK Command Injection Vulnerability Allowing Full System Compromise

A command injection vulnerability has been identified in Siemens SICAM SIAPP SDK versions prior to 2.1.7. The vulnerability arises because the application constructs shell commands using strings provided by the caller and executes them. This flaw allows an attacker to manipulate the executed command, potentially leading to command injection and complete system compromise.

Impact

Exploitation of this vulnerability could result in unauthorized command execution, allowing an attacker to compromise the entire system.

Remediation

Users are advised to update to SICAM SIAPP SDK version 2.1.7 or later. The latest version can be downloaded from the Siemens GitHub repository.