CVE-2026-69108

A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-077553.html

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary	(es) Una vulnerabilidad ha sido identificada en Siemens License Server (SLS) (Todas las versiones < V5.1). La aplicación afectada es vulnerable a una escalada de privilegios local debido a una política de sudoers insegura. Esto podría permitir a un atacante ejecutar comandos arbitrarios y plantar archivos maliciosos como root, lo que lleva a un compromiso total del sistema.	(es) Una vulnerabilidad ha sido identificada en Siemens License Server (SLS) (Todas las versiones anteriores a V5.1). La aplicación afectada es vulnerable a una escalada de privilegios local debido a una política de sudoers insegura. Esto podría permitir a un atacante ejecutar comandos arbitrarios y plantar archivos maliciosos como root, lo que lleva a un compromiso total del sistema.

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido identificada en Siemens License Server (SLS) (Todas las versiones < V5.1). La aplicación afectada es vulnerable a una escalada de privilegios local debido a una política de sudoers insegura. Esto podría permitir a un atacante ejecutar comandos arbitrarios y plantar archivos maliciosos como root, lo que lleva a un compromiso total del sistema.

Information

Published : 2026-08-11 13:19

Updated : 2026-10-23 23:10

NVD link : CVE-2026-69108

Mitre link : CVE-2026-69108

CVE.ORG link : CVE-2026-69108

JSON object : View

Products Affected

No product.

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-69108", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69108", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T14:47:11.495449Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "productcert@siemens.com", "affectedData": [{"vendor": "Siemens", "product": "Siemens License Server (SLS)", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.1", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-08-11T13:19:01.883", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-077553.html", "source": "productcert@siemens.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en Siemens License Server (SLS) (Todas las versiones anteriores a V5.1). La aplicaci\u00f3n afectada es vulnerable a una escalada de privilegios local debido a una pol\u00edtica de sudoers insegura. Esto podr\u00eda permitir a un atacante ejecutar comandos arbitrarios y plantar archivos maliciosos como root, lo que lleva a un compromiso total del sistema."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "productcert@siemens.com"}