Thales Sentinel LDK Run-Time Environment

An attacker with network access to port 1947 could connect to a licensing service that should have been decommissioned, potentially gaining unauthorized access to systems that depend on Sentinel LDK for license enforcement. This could affect any industrial application or control system that uses Sentinel LDK for copy protection.

This vulnerability affects any industrial control system, SCADA device, or engineering workstation that uses Thales Sentinel LDK for license management. Specific affected products include Halliburton GOHFER and other licensed software that relies on Sentinel LDK for copy protection. Water authorities and utilities with oilfield equipment (such as well monitoring or drilling supervision software) are at risk if they have uninstalled these products incompletely.

An attacker discovers that port 1947 is open on a device where Sentinel LDK was uninstalled. The attacker connects to this port and interacts with the Sentinel License Manager service, which may still be running or improperly decommissioned. Depending on the service state, the attacker could query licensing information, bypass license checks, or potentially execute commands on the affected system.