by Kastro
Paper/Archive/CVE-2024-44087

CVE-2024-44087

Siemens Automation License Manager V5 — A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0…

EPSS 11%CVSS 9.2
critical.is priorityof 100
47
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 95.9.959 × 2019.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), Automation License Manager V6.2 (All versions < V6.2 Upd3). Affected applications do not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated remote attacker to cause an integer overflow and crash of the application. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification.

Affected

ProductAffectedFixed inSource
Automation License Manager V5all versions–CNA
Automation License Manager V6.0< V6.0 SP12 Upd3V6.0 SP12 Upd3CNA
Automation License Manager V6.2< V6.2 Upd3V6.2 Upd3CNA
automation_license_manager5.0 – < 6.2_upd36.2_upd3CISA-ADP

Scores by source

siemens (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
siemens (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcert-portal.siemens.com/productcert/html/ssa-103653.html