CVE-2024-41171

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-10 · updated 2026-06-17
Weakness: CWE-732

Description

A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system.

Affected products

Siemens Sinumerik 828D Firmware: from 4.0 before 5.24 — fixed in 5.24
Siemens Sinumerik 840D Sl Firmware: from 4.0
Siemens Sinumerik One Firmware: before 6.24 — fixed in 6.24

How to fix

Upgrade to a fixed version: Siemens Sinumerik 828D Firmware 5.24; Siemens Sinumerik One Firmware 6.24. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-342438.html

Get alerted when CVE-2024-41171 or the next vulnerability affects your stack