{"id":"CVE-2025-29999","aliases":["EUVD-2025-10332","GHSA-q45g-xfv8-qx7w"],"status":"published","title":"A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The...","description":"A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The affected application searches for executable files in the application folder without proper validation.\r\nThis could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00163,"percentile":0.05582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2025-04-08T08:22:28Z","modified":"2026-06-17T09:06:03Z","products":[{"vendor":"siemens","product":"siemens license server (sls)"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-525431.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29999"},{"url":"https://github.com/advisories/GHSA-q45g-xfv8-qx7w"}],"sources":{"cve":[{"id":"CVE-2025-29999","description":"A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The affected application searches for executable files in the application folder without proper validation.\r\nThis could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory.","status":"published","published":"2025-04-08T08:22:28.099Z","modified":"2025-04-08T13:26:14.84Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:32:46.109993Z"}],"euvd":[{"id":"EUVD-2025-10332","description":"A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The affected application searches for executable files in the application folder without proper validation.\r\nThis could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory.","status":"published","published":"2025-04-08T08:22:28Z","modified":"2025-04-08T13:26:14Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:40.600826Z"}],"ghsa":[{"id":"GHSA-q45g-xfv8-qx7w","title":"A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The...","description":"A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The affected application searches for executable files in the application folder without proper validation.\nThis could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory.","status":"published","published":"2025-04-08T09:31:12Z","modified":"2025-04-08T09:31:19Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:00:50.553011Z"}],"nvd":[{"id":"CVE-2025-29999","description":"A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The affected application searches for executable files in the application folder without proper validation.\r\nThis could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory.","status":"published","published":"2025-04-08T09:15:27.053Z","modified":"2026-06-17T09:06:03.3Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:10:59.48027Z"}]}}