CVE-2023-52952 Security feature bypass in HiMed Cockpit 12 pro
An unauthenticated local attacker can escape the restricted Kiosk Mode environment to gain access to the underlying operating system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-52952?
CVE-2023-52952 is a critical vulnerability in Siemens HiMed Cockpit 12 pro, published on 8 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (J31032-K2017-H435) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro (J31032-K2017-H260) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro+ (J31032-K2017-H436) (All versions >= V11.5.1 < V11.6.2). The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to escape the restricted environment and gain access to the underlying operating system.
Weakness: CWE-424
Which versions are affected by CVE-2023-52952?
How do I fix CVE-2023-52952?
No fix has been published for CVE-2023-52952 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-52952 being exploited?
There is no known exploitation of CVE-2023-52952 in the wild and no public exploit code.
Sources
Also known as GHSA-6wwp-wcg5-rj5m.