SSA-476715 — Vulnetix

SSA-476715 PUBLISHED CVSS 8.199999809265137 HIGH

Siemens Automation License Manager contains two vulnerabilities which, when combined, could allow an attacker to modify and rename license files, extract licenses and overwrite arbitrary files on the target system potentially leading to privilege escalation and remote code execution. The affected functionality is not available for remote attackers in the default configuration since version V6.0 SP2 of Automation License Manager. Siemens has released an update for Automation License Manager V6 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Risk Scores

CVSS v3.1

8.199999809265137

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C

Affected Products

Vendor	Product	Versions
	Automation License Manager V5
	Automation License Manager V6

Timeline

CVE Published

References

https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf advisory
https://cert-portal.siemens.com/productcert/txt/ssa-476715.txt advisory
https://cert-portal.siemens.com/productcert/csaf/ssa-476715.json advisory
https://support.industry.siemens.com/cs/ww/en/view/114358/ fix

Open in Interactive Console →