CVE-2020-10051: siemens ag simatic rtls locating manager Unquoted Search Path or Element

Vulnerability summary

CVE-2020-10051 is a high (CVSS 7.8) Unquoted Search Path or Element vulnerability in siemens ag simatic rtls locating manager. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.4% of scored vulnerabilities.

Timeline

1. 09-09-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.

• CWE-428Unquoted Search Path or ElementThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.