Siemens Automation License Manager
By the Year
In 2024 there have been 0 vulnerabilities in Siemens Automation License Manager . Last year Automation License Manager had 2 security vulnerabilities published. Right now, Automation License Manager is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 2 | 8.65 |
| 2022 | 0 | 0.00 |
| 2021 | 1 | 7.50 |
| 2020 | 1 | 7.80 |
| 2019 | 0 | 0.00 |
| 2018 | 2 | 7.30 |
It may take a day or so for new Automation License Manager vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Siemens Automation License Manager Security Vulnerabilities
A vulnerability has been identified in Automation License Manager V5 (All versions)
CVE-2022-43513
7.5 - High
- January 10, 2023
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user.
Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in Automation License Manager V5 (All versions)
CVE-2022-43514
9.8 - Critical
- January 10, 2023
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected component does not correctly validate the root path on folder related operations, allowing to modify files and folders outside the intended root directory. This could allow an unauthenticated remote attacker to execute file operations of files outside of the specified root folder. Chained with CVE-2022-43513 this could allow Remote Code Execution.
Directory traversal
A vulnerability has been identified in Automation License Manager 5 (All versions)
CVE-2021-25659
7.5 - High
- August 10, 2021
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0 SP9 Update 2). Sending specially crafted packets to port 4410/tcp of an affected system could lead to extensive memory being consumed and as such could cause a denial-of-service preventing legitimate users from using the system.
Resource Exhaustion
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8)
CVE-2020-7583
7.8 - High
- August 14, 2020
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8). The application does not properly validate the users' privileges when executing some operations, which could allow a user with low permissions to arbitrary modify files that should be protected against writing.
AuthZ
A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4)
CVE-2018-11455
8.8 - High
- August 07, 2018
A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6.0.1). A directory traversal vulnerability could allow a remote attacker to move arbitrary files, which can result in code execution, compromising confidentiality, integrity and availability of the system. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges or special conditions of the system, but user interaction is required.
Directory traversal
A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4)
CVE-2018-11456
5.8 - Medium
- August 07, 2018
A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4). An attacker with network access to the device could send specially crafted network packets to determine whether or not a network port on another remote system is accessible or not. This allows the attacker to do basic network scanning using the victims machine. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges, no user interaction is required. The impact is limited to determining whether or not a port on a target system is accessible by the affected device.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Siemens Automation License Manager or by Siemens? Click the Watch button to subscribe.
