Automation License Manager Vulnerability Could Lead to Remote Code Execution

CVE-2024-44087

Summary

A vulnerability has been identified in Siemens Automation License Manager that affects versions V5, V6.0, and V6.2 (prior to V6.2 Upd3). The issue arises from the application's improper validation of fields in incoming network packets transmitted on port 4410/tcp. As a result, an unauthenticated remote attacker could exploit this vulnerability to trigger an integer overflow, leading to a crash of the affected application. This denial of service may disrupt operations, preventing legitimate users from accessing subsequent products that depend on the license verification functions of Automation License Manager.

References