CVE-2015-1594

Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to gain privileges via a Trojan horse application file.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.9 UNKNOWN
LOCAL
MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
VendorProductVersion
siemensstarter
𝑥
≤ 4.4
siemenssimatic_prosave
13.0
siemenssimotion_scout
𝑥
≤ 4.3
siemenssimatic_cfc
𝑥
≤ 8.0
siemenssimatic_cfc
8.1
siemenssimatic_step_7
𝑥
≤ 5.5
siemenssimatic_step_7
5.5:sp2
siemenssimatic_step_7
5.5:sp3
siemenssimatic_step_7
5.5:sp4
𝑥
= Vulnerable software versions
References
http://www.securitytracker.com/id/1032039
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-451236.pdf
http://www.securitytracker.com/id/1032039
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-451236.pdf