CVE-2020-7583: 
Siemens Automation License Manager vulnerability analysis and mitigation

The vulnerability (CVE-2020-7583) affects Siemens Automation License Manager (ALM), a software management platform. Discovered and reported by Lasse Trolle Borup of Danish Cyber Defense, this vulnerability was disclosed on August 11, 2020. The issue affects ALM version 5 (all versions) and ALM version 6 (versions prior to v6.0.8). The vulnerability stems from improper validation of user privileges when executing certain operations (CISA Advisory).

The vulnerability is classified as an Improper Authorization issue (CWE-285). The application fails to properly validate users' privileges when executing certain operations, which could allow an attacker with low permissions to arbitrarily modify files that should be protected against writing. The vulnerability has been assigned a CVSS v3.1 base score of 7.3, with the vector string: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H (CISA Advisory).

If successfully exploited, this vulnerability could allow an attacker to locally escalate privileges and modify files that should be protected against writing. This could potentially lead to unauthorized access to sensitive data and system modifications (CISA Advisory).

The vulnerability requires local access and low privileges to exploit. No known public exploits specifically targeting this vulnerability have been reported. The vulnerability is not exploitable remotely (CISA Advisory).

Siemens has released version 6.0.8 as a fix for this vulnerability. For users of License Manager 5, Siemens recommends disabling access to drives which have licenses installed for non-administrator users. For License Manager 6 users, updating to v6.0.8 or later version is recommended. Additionally, Siemens strongly recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' operational guidelines for Industrial Security (CISA Advisory).