Back

CVE-2024-44087

Sept. 10, 2024, 12:09 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Automation License Manager

  • V5
  • V6.0
  • V6.2 < V6.2 Upd3

Source

productcert@siemens.com

Tags

CWE-190
productcert@siemens.com
2024-09-10
CVE-2024-44087

CVE-2024-44087 details

Published : Sept. 10, 2024, 10:15 a.m.
Last Modified : Sept. 10, 2024, 12:09 p.m.

Description

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions), Automation License Manager V6.2 (All versions < V6.2 Upd3). Affected applications do not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated remote attacker to cause an integer overflow and crash of the application. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification.

CVSS Score

1 2 3 4 5 6 7 8.6 9 10

Weakness

Weakness Name Description
CWE-190 Integer Overflow or Wraparound The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

8.6

Exploitability Score

3.9

Impact Score

4.0

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

References

URL Source
https://cert-portal.siemens.com/productcert/html/ssa-103653.html productcert@siemens.com
This website uses the NVD API, but is not approved or certified by it.