Siemens SINEC NMS and User Management Component Local Privilege Escalation Vulnerability Allowing Arbitrary Code Execution

A local privilege escalation vulnerability has been identified in Siemens SINEC NMS and the User Management Component (UMC) versions prior to 2.15.2.1. This vulnerability allows a low-privileged user to improperly modify a configuration file, potentially leading to the execution of malicious DLLs and arbitrary code with SYSTEM privileges.

Impact

Exploitation of this vulnerability could result in unauthorized modification of configuration files, allowing for the execution of malicious DLLs and arbitrary code with elevated SYSTEM privileges.

Remediation

Users of the User Management Component (UMC) should update to version 2.15.2.1 or later. For more information, visit the Siemens support page.