CVE-2022-43513: siemens automation_license_manager External Control of File Name or Path

Vulnerability summary

CVE-2022-43513 is a high (CVSS 8.2) External Control of File Name or Path vulnerability in siemens automation_license_manager. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61% of scored vulnerabilities.

Timeline

1. 10-01-2023
   PublishedVulnerability first disclosed.
2. 09-04-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user.

• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
• CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.