CVE-2022-43514: 
Siemens Automation License Manager vulnerability analysis and mitigation

A vulnerability (CVE-2022-43514) was identified in Siemens Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), and TeleControl Server Basic V3 (All versions < V3.1.2). The vulnerability was disclosed on October 19, 2022, and involves improper validation of root paths in folder-related operations (CVE Mitre, Siemens Advisory).

The vulnerability stems from incorrect validation of the root path during folder-related operations, which allows modification of files and folders outside the intended root directory. The vulnerability has been assigned a CVSS v3.1 base score of 7.7 with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L. This indicates a high severity issue with network accessibility requiring no privileges or user interaction (NVD, Siemens Advisory).

An unauthenticated remote attacker could exploit this vulnerability to execute file operations outside of the specified root folder. When chained with CVE-2022-43513, this vulnerability could enable Remote Code Execution. The impact includes potential unauthorized file modifications and system compromise (Siemens Advisory).

The vulnerability can be exploited by an unauthenticated remote attacker. The affected functionality is not available for remote attackers in the default configuration since version V6.0 SP2 of Automation License Manager. When combined with CVE-2022-43513, it could allow for remote code execution (Siemens Advisory).

Siemens has released updates to address this vulnerability and recommends updating to V6.0 SP9 Upd4 or later version for Automation License Manager V6. For systems where updates are not available, Siemens recommends disabling 'Allow Remote Connections' if no remote connections are needed, and limiting remote access to port 4410/tcp to trusted systems only if remote connections are required (Siemens Advisory).