CVE-2020-15797 Privilege escalation in DCA Vantage Analyzer
An unauthenticated attacker with physical access can escape kiosk mode to access the underlying operating system, requiring an upgrade to V4.5.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15797?
CVE-2020-15797 is a medium-severity vulnerability in Siemens DCA Vantage Analyzer, published on 13 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running software V4.4.0 are also affected by CVE-2020-15797). Improper Access Control could allow an unauthenticated attacker to escape from the restricted environment (“kiosk mode”) and access the underlying operating system. Successful exploitation requires direct physical access to the system.
Weakness: CWE-269
Which versions are affected by CVE-2020-15797?
It affects 1 product.
Products include Siemens Dca Vantage Analyzer Firmware.
How do I fix CVE-2020-15797?
No fix has been published for CVE-2020-15797 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-15797 being exploited?
There is no known exploitation of CVE-2020-15797 in the wild and no public exploit code.
Other vulnerabilities in Siemens DCA Vantage Analyzer
Sources
Also known as GHSA-jw78-mrpv-375c.