Siemens Sinumerik Edge vulnerabilities

2 CVEs affecting Siemens Sinumerik Edge, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-4034, published 2022-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability, published 2022-01-28. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-27. EPSS: 94.9% chance of exploitation in the next 30 days. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users…
CVE-2021-42027, published 2021-12-14. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SINUMERIK Edge (All versions < V3.2). The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow…