CVE-2022-24408: Siemens Sinumerik Mc Firmware

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify system files. A specific set of operations using sc could allow local attackers to escalate their privileges to root.

Affected products

• Siemens Sinumerik Mc Firmware: before 1.15 (fixed in 1.15); version 1.15 only
• Siemens Sinumerik One Firmware: before 6.15 (fixed in 6.15); version 6.15 only

Published 2022-03-08. Last modified 2026-06-17.