Full Report
Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Siemens License Server (SLS)
## CVE Details
- **CVE ID:** CVE-2026-69108
- **CVSS Score:** 6.0 (Medium) per CVSS v3.1 / 8.3 (High) per CVSS v4.0
- **CWE:** CWE-732: Incorrect Permission Assignment for Critical Resource
- **CVE ID:** CVE-2026-69109
- **CVSS Score:** 7.5 (High) per CVSS v3.1 / 8.7 (High) per CVSS v4.0
- **CWE:** CWE-35: Path Traversal
## Affected Systems
- **Products:** Siemens License Server (SLS), which includes FlexNet License Manager Daemon (lmgrd) and the Siemens (saltd) vendor daemon.
- **Versions:**
- All versions < V5.1 (Affected by CVE-2026-69108)
- All versions < V5.3 (Affected by CVE-2026-69109)
- **Configurations:** Systems utilizing Siemens Advanced Licensing Technology (SALT) within EDA and PLM product families.
## Vulnerability Description
The Siemens License Server is affected by two distinct security flaws:
1. **CVE-2026-69108 (Privilege Escalation):** The application contains an insecure sudoers policy. An attacker with existing high-privileged local access can exploit this misconfiguration to execute arbitrary commands and plant malicious files as the root user.
2. **CVE-2026-69109 (Path Traversal):** The application fails to properly sanitize user input, leading to a path traversal vulnerability. This allows an unauthenticated remote attacker to bypass directory restrictions and read arbitrary files from the server's filesystem.
## Exploitation
- **Status:** No reports of exploitation in the wild provided; no Public PoC mentioned in the advisory.
- **Complexity:** Low (for both vulnerabilities).
- **Attack Vector:**
- **CVE-2026-69108:** Local (Requires local access to the server).
- **CVE-2026-69109:** Network (Can be exploited remotely).
## Impact
- **Confidentiality:** High (Both vulnerabilities allow unauthorized access to sensitive system or application files).
- **Integrity:** High (CVE-2026-69108 allows command execution and file modification as root).
- **Availability:** None (Neither vulnerability is specifically noted for causing Denial of Service).
## Remediation
### Patches
Siemens recommends updating to the following versions:
- **Siemens License Server V5.3 or later:** Resolves both CVE-2026-69108 and CVE-2026-69109.
- **Siemens License Server V5.1:** Resolves CVE-2026-69108 only.
The updates can be found at the Siemens Support Center:
[https://support.sw.siemens.com/product/1586485382/](https://support.sw.siemens.com/product/1586485382/)
### Workarounds
No specific software workarounds are provided. Siemens recommends the following general mitigations:
- Protect network access to the license server with appropriate perimeter security (firewalls/VLANs).
- Follow Siemens’ operational guidelines for Industrial Security to ensure the device operates in a protected IT environment.
## Detection
- **Indicators of Compromise:** Monitor for unusual file access patterns (e.g., attempts to access `../` sequences in web or application logs) and unauthorized use of `sudo` commands associated with the SLS service accounts.
- **Detection methods and tools:** Audit sudoers configuration files for non-standard or overly permissive entries related to Siemens License Server components.
## References
- **Vendor Advisory:** [https://cert-portal.siemens.com/productcert/html/ssa-077553.html](https://cert-portal.siemens.com/productcert/html/ssa-077553.html)
- **General Security Recommendations:** [https://www.siemens.com/cert/operational-guidelines-industrial-security](https://www.siemens.com/cert/operational-guidelines-industrial-security)