Path traversal in Siemens Automation License Manager 5, Automation License Manager 6
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6.0.1). A directory traversal vulnerability could allow a remote attacker to move arbitrary files, which can result in code execution, compromising confidentiality, integrity and availability of the system. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges or special conditions of the system, but user interaction is required.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Automation License Manager 5, Automation License Manager 6 | Automation License Manager 5 : All versions < 5.3.4.4; Automation License Manager 6 : All versions < 6.0.1 | — | No fix listed | CNA |
- Automation License Manager 5, Automation License Manager 6 VendorSiemens Affected Automation License Manager 5 : All versions < 5.3.4.4; Automation License Manager 6 : All versions < 6.0.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:automation_license_manager:*:*:*:*:*:*:*:* | after 5.0, before 5.3.4.4; 6.0 to before 6.0.1 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:automation_license_manager:*:*:*:*:*:*:*:* Versions after 5.0, before 5.3.4.4; 6.0 to before 6.0.1 Vulnerable ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11455
- 2026-10-03 Alias added: GHSA-q23v-cmj9-h93q
References
More Siemens Automation License Manager vulnerabilities
- TI-2022-21296 Path traversal in Siemens Automation License Manager V5 CVSS 3.1CRITICAL 9.8
- TI-2016-07037 Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to write… CVSS 3.0CRITICAL 9.1
- TI-2022-21295 A vulnerability has been identified in Automation License Manager V5 (All versions)… CVSS 3.1HIGH 8.2
- TI-2011-03900 Multiple buffer overflows in Siemens Automation License Manager (ALM) 4.0 through… CVSS 2.0HIGH 7.5
- TI-2016-07035 Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers… CVSS 3.0HIGH 7.5
- TI-2021-07791 Uncontrolled resource consumption in Siemens Automation License Manager 5 CVSS 3.1HIGH 7.5
Sources
- CVE-2018-11455 · CVE Program
- CVE-2018-11455 · NVD
- FIRST EPSS
- GHSA-q23v-cmj9-h93q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences