Improper Authorization in Siemens SINEC Security Monitor ssmctl-client file_transfer

Successful exploitation allows an authenticated local attacker with low privileges to perform arbitrary file read and write operations on the affected server or sensor. This can expose sensitive information, enable unauthorized modification of files, and potentially facilitate further compromise depending on which files are accessed or altered. The provided CVSS v3.1 vector indicates high confidentiality, integrity, and availability impact (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), although the narrative description specifically emphasizes arbitrary file access on the target system.

If immediate upgrade is not possible, limit access to the affected system and the ssmctl-client file_transfer functionality to only strictly necessary users and administrative contexts, review and tighten authorization configurations, and apply Siemens industrial security guidance. CISA additionally recommends minimizing network exposure of control system devices, ensuring they are not directly accessible from the internet, isolating control networks from business networks with firewalls, and using secure remote access methods such as VPNs.

Siemens recommends updating SINEC Security Monitor to version V4.10.0 or later. This is the vendor-provided remediation for the vulnerability.