{"id":"CVE-2020-10051","aliases":["EUVD-2020-2516","GHSA-v53h-89xp-f8xj"],"status":"published","title":"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2)....","description":"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00328,"percentile":0.26261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-428"],"published":"2020-09-09T18:09:58Z","modified":"2026-06-17T02:47:15Z","products":[{"vendor":"siemens","product":"simatic rtls locating manager"},{"vendor":"siemens","product":"simatic_rtls_locating_manager"},{"vendor":"siemens ag","product":"simatic rtls locating manager"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10051"},{"url":"https://github.com/advisories/GHSA-v53h-89xp-f8xj"}],"sources":{"cve":[{"id":"CVE-2020-10051","description":"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.","status":"published","published":"2020-09-09T18:09:58Z","modified":"2024-08-04T10:50:57.83Z","cwes":["CWE-428"],"updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-2516","description":"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.","status":"published","published":"2020-09-09T18:09:58Z","modified":"2024-08-04T10:50:57Z","updated_at":"2026-11-03T03:07:51.449946Z"}],"ghsa":[{"id":"GHSA-v53h-89xp-f8xj","title":"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2)....","description":"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.","status":"published","published":"2022-05-24T17:27:36Z","modified":"2023-01-29T05:03:48Z","updated_at":"2026-11-02T14:45:24.208268Z"}],"nvd":[{"id":"CVE-2020-10051","description":"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.","status":"published","published":"2020-09-09T19:15:18.587Z","modified":"2026-06-17T02:47:15.563Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-428"],"updated_at":"2026-11-02T14:06:14.981587Z"}]}}