Executive brief
Horizon Security Analyzer is a network security management platform used to analyze and manage firewall configurations. A misconfiguration in the sudoers file allows local users with command-line access to escalate their privileges by manipulating command parameters, potentially gaining unrestricted system access. This affects organizations using affected versions on Linux systems and requires immediate patching to prevent unauthorized privilege escalation.
Technical details
This is an improper privilege management vulnerability arising from a misconfigured sudoers entry that allows parameter injection. A local attacker with command-line access can abuse the parameters of an approved sudoers command to escalate privileges beyond their intended scope. The vulnerability requires local access and does not require authentication credentials beyond existing shell access. An attacker can achieve full privilege escalation and arbitrary command execution with elevated permissions. The issue is fixed in Horizon Security Analyzer A33.10 build 310+, A33.20 build 180+, and A33.30 build 120+.
Affected products
- Siemens Healthineers Horizon Security Analyzer A33.10 (up to build 300), A33.20 (up to build 170), A33.30 (up to build 110)
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in A33.10 build 310+, A33.20 build 180+, A33.30 build 120+