PT-2018-10585 · Rockwell Automation · Automation License Manager

Published 2018-08-07 · Updated 2019-10-09 · CVE-2018-11456

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Automation License Manager 5 versions prior to 5.3.4.4

Description A vulnerability allows an attacker with network access to send specially crafted network packets to determine the accessibility of a network port on a remote system. This enables the attacker to perform basic network scanning using the victim's machine. Successful exploitation requires a network connection to the affected device and does not need privileges or user interaction. The impact is limited to determining port accessibility on a target system.

Recommendations For Automation License Manager 5 versions prior to 5.3.4.4, update to version 5.3.4.4 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2018-11456

Affected Products

Automation License Manager

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-920962.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11456 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11456 · Vendor Advisory
• http://securityfocus.com/bid/105114 · Note