CVE-2018-11455

HIGH

Automation License Manager < 5.3.4.4 and < 6.0.1 - Path Traversal and Arbitrary File Write

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6.0.1). A directory traversal vulnerability could allow a remote attacker to move arbitrary files, which can result in code execution, compromising confidentiality, integrity and availability of the system. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges or special conditions of the system, but user interaction is required.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105114

Scores

CVSS v3 8.8
EPSS 0.0253
EPSS Percentile 85.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (1)
siemens/automation_license_manager 5.0 - 5.3.4.4
Published Aug 07, 2018
Tracked Since Feb 18, 2026