A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user.
Source: Siemens AG
Max CVSS
8.2
EPSS Score
0.16%
Published
2023-01-10
Updated
2024-04-09
A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
Source: MITRE
Max CVSS
7.8
EPSS Score
0.05%
Published
2021-10-01
Updated
2022-04-24
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.
Source: Siemens AG
Max CVSS
7.5
EPSS Score
0.11%
Published
2022-11-17
Updated
2022-11-21
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.
Source: Siemens AG
Max CVSS
7.5
EPSS Score
0.11%
Published
2022-11-17
Updated
2022-11-21
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.
Source: Siemens AG
Max CVSS
7.5
EPSS Score
0.07%
Published
2022-11-17
Updated
2022-11-21
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.
Source: Siemens AG
Max CVSS
7.5
EPSS Score
0.07%
Published
2022-11-17
Updated
2022-11-21
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.
Source: Siemens AG
Max CVSS
7.5
EPSS Score
0.07%
Published
2022-11-17
Updated
2022-11-21
A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server  (All versions < V1.1), TIA Project-Server V16 (All versions), TIA Project-Server V17 (All versions < V17 Update 6). Affected applications contain an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path.
Source: Siemens AG
Max CVSS
7.3
EPSS Score
0.04%
Published
2023-02-14
Updated
2024-02-08
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload generic files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code execution.
Source: Siemens AG
Max CVSS
7.2
EPSS Score
0.04%
Published
2024-05-14
Updated
2024-05-14
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload firmware files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code execution.
Source: Siemens AG
Max CVSS
7.2
EPSS Score
0.04%
Published
2024-05-14
Updated
2024-05-14
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affected systems allow a privileged user to upload files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code execution.
Source: Siemens AG
Max CVSS
7.2
EPSS Score
0.04%
Published
2024-05-14
Updated
2024-05-14
11 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!