CVE-2018-11455
HIGHAutomation License Manager < 5.3.4.4 and < 6.0.1 - Path Traversal and Arbitrary File Write
Title source: llmDescription
A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6.0.1). A directory traversal vulnerability could allow a remote attacker to move arbitrary files, which can result in code execution, compromising confidentiality, integrity and availability of the system. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges or special conditions of the system, but user interaction is required.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/105114
Vendor Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-920962.pdf
Scores
CVSS v3
8.8
EPSS
0.0253
EPSS Percentile
85.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-22
Status
published
Products (1)
siemens/automation_license_manager
5.0 - 5.3.4.4
Published
Aug 07, 2018
Tracked Since
Feb 18, 2026