This vulnerability (CWE-266) exists in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) before version 5.8, where User Administrators are permitted to manage only groups they belong to. Due to improper privilege assignment, an authenticated User Administrator can escalate privileges by granting themselves access to any device group at any access level, potentially leading to full control over device groups. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by Siemens as of the data provided.

An authenticated User Administrator can escalate their privileges beyond intended limits, gaining unauthorized access to any device group at any access level. This can result in full compromise of device group management, potentially impacting confidentiality, integrity, and availability of the affected systems. The vulnerability is rated high severity with a CVSS score of 8.8. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, restrict User Administrator privileges to trusted personnel only and monitor for unauthorized privilege escalations. Avoid granting User Administrator access to untrusted users. Follow Siemens advisories for updates on patches or workarounds.