SecuriTricks - CVE-2023-52952

Description

A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (J31032-K2017-H435) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro (J31032-K2017-H260) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro+ (J31032-K2017-H436) (All versions >= V11.5.1 < V11.6.2). The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to escape the restricted environment and gain access to the underlying operating system.

Product(s) Impacted

Product	Versions
HiMed Cockpit 12 pro	['>= V11.5.1 < V11.6.2']
HiMed Cockpit 14 pro+	['>= V11.5.1 < V11.6.2']
HiMed Cockpit 18 pro	['>= V11.5.1 < V11.6.2']
HiMed Cockpit 18 pro+	['>= V11.5.1 < V11.6.2']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-424

Improper Protection of Alternate Path

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

References

https://cert-portal.siemens.com/productcert/html/ssa-540493.html

CVSS Score

8.5 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: NONE
Scope: CHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

View Vector String

Timeline

Published: Oct. 8, 2024, 9:15 a.m.
Last Modified: Oct. 10, 2024, 12:56 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

productcert@siemens.com

CVE-2023-52952