by Kastro
Paper/Archive/CVE-2023-52952

CVE-2023-52952

Siemens HiMed Cockpit 12 pro — A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro…

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
29
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 6.5.065 × 201.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (J31032-K2017-H435) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro (J31032-K2017-H260) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro+ (J31032-K2017-H436) (All versions >= V11.5.1 < V11.6.2). The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to escape the restricted environment and gain access to the underlying operating system.

Affected

ProductAffectedFixed inSource
HiMed Cockpit 12 proV11.5.1 – < V11.6.2V11.6.2CNA
HiMed Cockpit 14 pro+V11.5.1 – < V11.6.2V11.6.2CNA
HiMed Cockpit 18 proV11.5.1 – < V11.6.2V11.6.2CNA
HiMed Cockpit 18 pro+V11.5.1 – < V11.6.2V11.6.2CNA

Scores by source

siemens (CNA)9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H
siemens (CNA)8.5CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcert-portal.siemens.com/productcert/html/ssa-540493.html