Siemens SINEMA Server Privilege Escalation Vulnerability (Update A)

An attacker with standard user access to a SINEMA Server could escalate privileges to administrative level, potentially gaining control over network configuration, device management, and automation project settings critical to your power or process infrastructure.

Electric utilities and water authorities running Siemens SINEMA Server for network device management and automation control should address this issue. SINEMA Server is typically used to manage Siemens PLCs, drives, and HMI devices across distributed sites.

An attacker with a valid local user account on the SINEMA Server system (or with physical access to an unattended workstation) could trigger a privilege escalation condition that requires user interaction. Once escalated, the attacker would have administrative capabilities to modify configurations and access sensitive data.