CVE-2022-43513

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4, TeleControl Server Basic V3 All versions V3.1.2. The affected components allow to rename license files with user chosen input without authentication. This...

CVE-2022-43514

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4, TeleControl Server Basic V3 All versions V3.1.2. The affected component does not correctly validate the root path on folder related operations, allowing to...

Authentication flaw

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4. The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to...

Remote code execution

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4. The affected component does not correctly validate the root path on folder related operations, allowing to modify files and folders outside the intended roo...

CVE-2022-43514

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4, TeleControl Server Basic V3 All versions V3.1.2. The affected component does not correctly validate the root path on folder related operations, allowing to...

CVE-2022-43514

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4, TeleControl Server Basic V3 All versions V3.1.2. The affected component does not correctly validate the root path on folder related operations, allowing to...

CVE-2022-43514

CVE-2022-43514 affects Siemens Automation License Manager (ALM) 5.x, ALM 6.x (pre V6.0 SP9 Upd4) and TeleControl Server Basic (pre V3.1.2). The vulnerability is an improper validation of the root path during folder-related operations, allowing an unauthenticated attacker to perform file operation...

CVE-2022-43513

Siemens Automation License Manager and TeleControl Server Basic are affected by CVE-2022-43513 (and related CVEs). The root cause is external control of file name or path: input provided by unauthenticated users can rename and move license files as SYSTEM, enabling file operations outside the int...

CVE-2022-43513

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4, TeleControl Server Basic V3 All versions V3.1.2. The affected components allow to rename license files with user chosen input without authentication. This...

CVE-2022-43513

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4, TeleControl Server Basic V3 All versions V3.1.2. The affected components allow to rename license files with user chosen input without authentication. This...

Siemens Automation License Manager

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-1360 · Unknown · Telecontrol Server Basic V3 +2

Name of the Vulnerable Software and Affected Versions: Automation License Manager V5 All versions Automation License Manager V6 All versions prior to V6.0 SP9 Upd4 TeleControl Server Basic V3 All versions prior to V3.1.2 Description: The issue is related to a path traversal vulnerability. It may...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in SINEC INS, among others, SIMATIC, SINUMERIK, SIMOCODE, SIRPLUS, SCALANCE, JT Open, JT Utilities, Solid Edge, Automation License Manager, Mendix and RUGGEDCOM. The vulnerabilities potentially enable a malicious person to able to perform attacks that result in t...

CVE-2021-25659

A vulnerability has been identified in Automation License Manager 5 All versions, Automation License Manager 6 All versions V6.0 SP9 Update 2. Sending specially crafted packets to port 4410/tcp of an affected system could lead to extensive memory being consumed and as such could cause a...

CVE-2021-25659

A vulnerability has been identified in Automation License Manager 5 All versions, Automation License Manager 6 All versions V6.0 SP9 Update 2. Sending specially crafted packets to port 4410/tcp of an affected system could lead to extensive memory being consumed and as such could cause a...

CVE-2021-25659

A vulnerability has been identified in Automation License Manager 5 All versions, Automation License Manager 6 All versions V6.0 SP9 Update 2. Sending specially crafted packets to port 4410/tcp of an affected system could lead to extensive memory being consumed and as such could cause a...

Design/Logic Flaw

A vulnerability has been identified in Automation License Manager 5 All versions, Automation License Manager 6 All versions V6.0 SP9 Update 2. Sending specially crafted packets to port 4410/tcp of an affected system could lead to extensive memory being consumed and as such could cause a...

CVE-2021-25659

Siemens Automation License Manager (ALM) 5 (all versions) and ALM 6 (all versions before v6.0 SP9 Update 2) are affected by CVE-2021-25659. The issue is uncontrolled resource consumption: sending crafted packets to TCP port 4410 can exhaust memory and cause DoS, hindering legitimate users. A reme...

CVE-2021-25659

A vulnerability has been identified in Automation License Manager 5 All versions, Automation License Manager 6 All versions V6.0 SP9 Update 2. Sending specially crafted packets to port 4410/tcp of an affected system could lead to extensive memory being consumed and as such could cause a...

Siemens Automation License Manager

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: Automation License Manager Vulnerability: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial-of-service condition, preventing legitimate...