Siemens SINEC INS Privilege Escalation Vulnerability Allowing Root Access

A vulnerability exists in Siemens SINEC INS versions prior to V1.0 SP2 Update 6, where a binary is equipped with the cap_dac_override capability. This capability enables the process to circumvent file system permission checks, leading to unrestricted access to the file system. Consequently, a local attacker could exploit this to escalate privileges, allowing arbitrary file modifications and potentially gaining root access on the system.

Impact

Exploitation of this vulnerability could result in unauthorized privilege escalation, allowing a local attacker to gain root access on the system and modify files arbitrarily.

Remediation

Users are advised to update to Siemens SINEC INS version V1.0 SP2 Update 6 or later. For more information, visit the Siemens Industry Support page.