Vulnerability · Published Oct 8, 2024 · Assigned by siemens
CVE-2023-52952
High 8.5
In plain English
A high-severity security flaw in HiMed Cockpit 12 pro from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (J31032-K2017-H435) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro (J31032-K2017-H260) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro+ (J31032-K2017-H436) (All versions >= V11.5.1 < V11.6.2). The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to escape the restricted environment and gain access to the underlying operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | HiMed Cockpit 12 pro | V11.5.1 – before V11.6.2 |
| Siemens | HiMed Cockpit 14 pro+ | V11.5.1 – before V11.6.2 |
| Siemens | HiMed Cockpit 18 pro | V11.5.1 – before V11.6.2 |
| Siemens | HiMed Cockpit 18 pro+ | V11.5.1 – before V11.6.2 |
Weakness: CWE-424 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C