Siemens SLS Vulnerabilities: LPE via sudoers & Path Traversal (CVE-2026-69108/9)

Vulnerability Overview Vulnerability ID: SSA-077553 Vulnerability Name: Multiple Vulnerabilities in Siemens License Server (SLS) Release Date: 2026-08-11 Last Updated: 2026-08-11 Current Version: V1.0 CVSS v3.1 Base Score: 7.5 CVSS v4.0 Base Score: 8.7 Impact Scope Affected Product: Siemens License Server (SLS) Remediation Mitigation: Upgrade to the latest version Detailed Remediation Information: Show more details Vulnerability Details Vulnerability CVE-2026-69108 Description: A local privilege escalation vulnerability exists in the application due to an insecure sudoers policy. Attackers can execute arbitrary commands and run malicious code with root privileges, leading to full system compromise. CVSS v3.1 Base Score: 6.0 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/H:H CVSS v4.0 Base Score: 8.7 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/HV:N/SC:N/NSI:NSA:N CWE: CWE-732: Incorrect Permission Assignment for Critical Resource Vulnerability CVE-2026-69109 Description: A path traversal vulnerability exists in the application due to insufficient sanitization of user input, allowing attackers to access arbitrary files within the application. CVSS v3.1 Base Score: 7.5 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/H:N CVSS v4.0 Base Score: 8.7 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/HV:N/SC:N/NSI:NSA:N CWE: CWE-35: Path Traversal: '../' Additional Information General Security Recommendations: It is strongly recommended to implement general security measures, such as securing network-accessible devices and configuring the environment in compliance with industrial security guidelines. Product Description: This section describes all vulnerabilities (CVE-IDs) and their specific impact on the product. Acknowledgments: Thanks to Intet PSIRT for coordinated disclosure. More Information: For more information regarding security vulnerabilities in Siemens products and solutions, please contact Siemens ProductCERT. History V1.0 (2026-08-11): Release Date Terms of Use Use of Siemens Security Bulletins is subject to the relevant terms and conditions. --- Note: No POC code or exploit code is included on this page.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SLS Vulnerabilities: LPE via sudoers & Path Traversal (CVE-2026-69108/9)