CVE-2023-45205 Privilege escalation in SICAM PAS/PQS
An authenticated local attacker can exploit insecure file permissions to inject arbitrary code and escalate privileges to SYSTEM in Siemens SICAM PAS/PQS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-45205?
CVE-2023-45205 is a high-severity vulnerability in Siemens SICAM PAS/PQS, published on 10 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to `NT AUTHORITY/SYSTEM`.
Weakness: CWE-732
Which versions are affected by CVE-2023-45205?
It affects 1 product.
Products include Siemens Sicam Pas\/Pqs.
How do I fix CVE-2023-45205?
No fix has been published for CVE-2023-45205 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-45205 being exploited?
There is no known exploitation of CVE-2023-45205 in the wild and no public exploit code.
Other vulnerabilities in Siemens SICAM PAS/PQS
- CVE-2022-43724 Hardcoded credentials in SICAM PAS/PQS
- CVE-2016-8567 Hardcoded credentials in Siemens SICAM PAS before 8.00
- CVE-2016-9157 Denial of service in Siemens SICAM PAS through V8.08
- CVE-2022-43722 Code injection in SICAM PAS/PQS
- CVE-2016-8566 Hardcoded credentials in Siemens SICAM PAS before 8.00
Sources
Also known as GHSA-f4jh-j7c5-g9fp.