Full Report
Unicam FX contains a local privilege escalation vulnerability that could allow an attcker to gain SYSTEM privileges. Unicam FX has reached end of software maintanence. Further information on recommendations for successor product can be found in section ‘Additional Information’.
Analysis Summary
# Vulnerability: Local Privilege Escalation in Siemens Unicam FX
## CVE Details
- **CVE ID:** CVE-2024-22042
- **CVSS Score:** 7.8 (High) - CVSS v3.1 / 8.5 (High) - CVSS v4.0
- **CWE:** CWE-648 (Incorrect Use of Privileged APIs)
## Affected Systems
- **Products:** Unicam FX (PCB assembly process planning software)
- **Versions:** All versions
- **Configurations:** Systems running the Windows installer agent associated with the product.
## Vulnerability Description
The Windows installer agent used in Unicam FX incorrectly utilizes privileged APIs. This flaw triggers the Windows Console Host (`conhost.exe`) as a child process executing with **SYSTEM** privileges. A local attacker can exploit this behavior to execute arbitrary commands or code with the highest level of privileges on the Windows operating system.
## Exploitation
- **Status:** PoC available (indicated by CVSS:3.1/E:P)
- **Complexity:** Low
- **Attack Vector:** Local (Attacker must have local access to the machine)
## Impact
- **Confidentiality:** High (Full access to system data)
- **Integrity:** High (Full ability to modify system files and settings)
- **Availability:** High (Full ability to disrupt system operations)
## Remediation
### Patches
- **No patches are planned.** Unicam FX has reached end of software maintenance (EOSL).
### Workarounds
- **Product Migration:** Siemens recommends that users transition to the successor product, **Valor Process Preparation**, to receive ongoing security updates.
- **General Mitigation:**
- Restrict physical and interactive local access to authorized personnel only.
- Follow Siemens' operational guidelines for Industrial Security to protect the IT environment.
- Implement the principle of least privilege for local user accounts.
## Detection
- **Indicators of Compromise:** Monitor for unusual child processes spawned by the Unicam FX installer agent, specifically `conhost.exe` running with `NT AUTHORITY\SYSTEM` privileges initiated by a low-privileged user session.
- **Detection methods and tools:** Use Endpoint Detection and Response (EDR) tools to audit process creation events and API calls related to the installer agent.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-543502[.]pdf
- **Siemens Industrial Security Guidelines:** hxxps[://]www[.]siemens[.]com/cert/operational-guidelines-industrial-security
- **Successor Product Information:** hxxps[://]plm[.]sw[.]siemens[.]com/en-US/valor/process-preparation/