Vulnerability · Published Sep 9, 2020 · Assigned by siemens
CVE-2020-10056
High 7.8
In plain English
A high-severity security flaw in License Management Utility (LMU) from Siemens AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.4%top 69.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated attacker to execute arbitrary commands on the server with local SYSTEM privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens AG | License Management Utility (LMU) | All versions < V2.4 |
Weakness: CWE-250
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-709003.pdf x_refsource_MISC
- https://us-cert.cisa.gov/ics/advisories/icsa-20-252-03 x_refsource_MISC