CVE-2018-11456

2018-08-0715:00:00

CWE-284

siemens

www.cve.org

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.3%

JSON

A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4). An attacker with network access to the device could send specially crafted network packets to determine whether or not a network port on another remote system is accessible or not. This allows the attacker to do basic network scanning using the victims machine. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges, no user interaction is required. The impact is limited to determining whether or not a port on a target system is accessible by the affected device.

CNA Affected

[
  {
    "product": "Automation License Manager 5",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "Automation License Manager 5 : All versions < 5.3.4.4"
      }
    ]
  }
]