CVE-2021-25659
mediumPriorität · verfolgen · 30EPSS 0.010 · 64. PerzentilDEEUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0 SP9 Update 2). Sending specially crafted packets to port 4410/tcp of an affected system could lead to extensive memory being consumed and as such could cause a denial-of-service preventing legitimate users from using the system.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenAutomation License Manager 6siemens_psirt
Update to V6.0 SP9 Update 2 or later
https://support.industry.siemens.com/cs/ww/en/view/114358/ - BehobenAutomation License Manager 6cisa_csaf_ot
Update to V6.0 SP9 Update 2 or later
https://support.industry.siemens.com/cs/ww/en/view/114358/ - MitigationAutomation License Manager 5siemens_psirt
If remote connections are needed, limit remote access to port 4410/tcp to trusted systems only
- MitigationAutomation License Manager 6siemens_psirt
If remote connections are needed, limit remote access to port 4410/tcp to trusted systems only
- MitigationAutomation License Manager 5cisa_csaf_ot
If remote connections are needed, limit remote access to port 4410/tcp to trusted systems only
- MitigationAutomation License Manager 6cisa_csaf_ot
If remote connections are needed, limit remote access to port 4410/tcp to trusted systems only
- Kein Fix verfügbarAutomation License Manager 5siemens_psirt
Currently no remediation is available
- Kein Fix verfügbarAutomation License Manager 5cisa_csaf_ot
Currently no remediation is available
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (9)
Betroffene Produkte und Versionsbereiche.
- siemens automation license manager5.0.0 → 6.0.9nvdUScpe:2.3:a:siemens:automation_license_manager:*:*:*:*:*:*:*:*
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-158827SSA-158827: Denial-of-Service Vulnerability in Automation License Manager2021-08-10csaf · siemens_psirtDE
A vulnerability was identified in the Automation License Manager software that could be triggered by sending specially crafted packets to port 4410/tcp of an affected system. This could cause a denial-of-service preventing legitimate users from using the system. Siemens has released an update for the Automation License Manager 6 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
- ICSA-21-222-02Siemens Automation License Manager2021-08-10icsa · cisa_csaf_otUS
A vulnerability was identified in the Automation License Manager software that could be triggered by sending specially crafted packets to port 4410/tcp of an affected system. This could cause a denial-of-service preventing legitimate users from using the system. Siemens has released an update for the Automation License Manager 6 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-158827.pdfcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-222-02cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2701cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021081105cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-158827.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-158827.pdfPatchVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan