CVE-2024-22042

Published Feb 13, 2024

Last updated 2 months ago

Overview

Description: A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use of privileged APIs that trigger the Windows Console Host (conhost.exe) as a child process with SYSTEM privileges. This could be exploited by an attacker to perform a local privilege escalation attack.
Source: productcert@siemens.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

productcert@siemens.com: CWE-648
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:siemens:unicam_fx:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7C6D5ECF-74F5-4FC8-90B5-DC4C3348BB40"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References