As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
- CVSS v4 2.1
- ATTENTION: Exploitable remotely
- Vendor: Siemens
- Equipment: Mendix OIDC SSO
- Vulnerability: Incorrect Privilege Assignment
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to modify the system and gain administrator read/write privileges.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports the following products are affected:
- Siemens Mendix OIDC SSO (Mendix 9 compatible): All versions
- Siemens Mendix OIDC SSO (Mendix 10 compatible): All versions before V4.0.0
3.2 VULNERABILITY OVERVIEW
3.2.1 INCORRECT PRIVILEGE ASSIGNMENT CWE-266
The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role, which could result in privilege misuse by an adversary modifying the module during Mendix development.
CVE-2025-40571 has been assigned to this vulnerability. A CVSS v3.1 base score of 2.2 has been calculat
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: