CVE-2025-23403CWE-732

A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions)

High · published February 11, 2025

CVSS v4.0
7.3
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do not properly restrict the user permission for the registry key. This could allow an authenticated attacker to load vulnerable drivers into the system leading to privilege escalation or bypassing endpoint protection and other security measures.

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00149 · 3.8th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-02-11T10:29Z
EPSS history
Timeline
  • 11 FEB 10:29Z
    A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions)
    cvelistv5