Siemens SINUMERIK ONE, SINUMERIK 840D and SINUMERIK 828D

SINUMERIK ONE, SINUMERIK 840D sl, and SINUMERIK 828D are affected by a privilege escalation vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) in the underlying operating system or file permission structure. An authenticated local attacker with valid user credentials could exploit improper file permissions to escalate privileges and gain elevated control over the machine, potentially modifying machine logic, programs, or security configurations. The vulnerability requires local access and valid credentials, limiting the attack surface to operators, maintenance technicians, or engineering staff with system access. Siemens has released fixes for SINUMERIK 828D V5 (version 5.24 or later) and SINUMERIK ONE (version 6.24 or later). SINUMERIK 828D V4 and SINUMERIK 840D sl V4 have no planned fixes and remain vulnerable. Siemens recommends implementing network segmentation, access controls, and following industrial security best practices as compensating controls for unfixed versions.