Skip to content
Fencer Vulns
high 8.6

CVE-2024-44087 in the critical feed json

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 S…

published 2024-09-10 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-40855

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
10.9%
EPSS 10.9% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), Automation License Manager V6.2 (All versions < V6.2 Upd3). Affected applications do not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated remote attacker to cause an integer overflow and crash of the application. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification.

Patch / fix

  • Siemens Automation License Manager V6.0 V6.0 SP12 Upd3
  • Siemens Automation License Manager V6.2 V6.2 Upd3
  • siemens automation_license_manager 6.2_upd3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-256-06 updated cvss 8.6

Siemens Automation License Manager

  • Siemens Automation License Manager V5
    affected: mitigation, no fix planned
  • Siemens Automation License Manager V6.0 <V6.0_SP12_Upd3
    affected: fixed in V6.0, mitigation support.industry.siemens.com
  • Siemens Automation License Manager V6.2 <V6.2_Upd3
    affected: fixed in V6.2, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

10.87% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Siemens Automation License Manager V5
  • Siemens Automation License Manager V6.0
  • Siemens Automation License Manager V6.2
  • siemens automation_license_manager

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.