PT-2025-15406 · Siemens · Siemens License Server

Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-29999

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Siemens License Server (SLS) versions prior to V4.3

Description: A vulnerability has been identified where the affected application searches for executable files in the application folder without proper validation. This could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory.

Recommendations: For versions prior to V4.3, update to version V4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the application folder to prevent malicious executables from being placed in the directory.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-04277

CVE-2025-29999

Affected Products

Siemens License Server

References · 6

• https://bdu.fstec.ru/vul/2025-04277 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-29999 · Security Note
• https://t.me/cvedetector/22442 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-525431.html · Note
• https://t.me/cvetracker/21113 · Telegram Post
• https://twitter.com/CVEnew/status/1909528262235373609 · Twitter Post