Siemens Ag Simatic Rtls Locating Manager vulnerabilities

CVE-2020-10051 [HIGH] CWE-428 CVE-2020-10051: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multi A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.

CVE-2020-10050 [HIGH] CWE-276 CVE-2020-10050: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The d A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.

CVE-2020-10049 [HIGH] CWE-276 CVE-2020-10049: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The s A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The start-stop scripts for the services of the affected application could allow a local attacker to include arbitrary commands that are executed when services are started or stopped interactively by system administrators.