Log in / Sign up

Vulnerability details

CVE-2024-49775

Siemens Opcenter Execution FoundationSiemens Opcenter IntelligenceSiemens Opcenter QualitySiemens Opcenter RDnLSiemens SIMATIC PCS neoSiemens SINEC NMS
CVSS 4.0
9.3Critical

Official description

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions if operated in conjunction with UMC < V2.15), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.

CVSS scores

ScoreVersionSourceVector
9.3Critical 4.0 CVEProject cvelistV5 (CNA) (siemens) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.8Critical 3.1 CVEProject cvelistV5 (CNA) (siemens) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
Siemens Opcenter Execution Foundation v < V2501.0001 CVEProject cvelistV5 (CNA)
Siemens Opcenter Intelligence v < V2501.0001 CVEProject cvelistV5 (CNA)
Siemens Opcenter Quality v < V2512 CVEProject cvelistV5 (CNA)
Siemens Opcenter RDnL v < V2410 CVEProject cvelistV5 (CNA)
Siemens SIMATIC PCS neo V4.0 All CVEProject cvelistV5 (CNA)
Siemens SIMATIC PCS neo V4.1 v < V4.1 Update 3 CVEProject cvelistV5 (CNA)
Siemens SIMATIC PCS neo V5.0 v < V5.0 Update 1 CVEProject cvelistV5 (CNA)
Siemens SINEC NMS All CVEProject cvelistV5 (CNA)
Siemens Totally Integrated Automation Portal (TIA Portal) V16 All CVEProject cvelistV5 (CNA)
Siemens Totally Integrated Automation Portal (TIA Portal) V17 All CVEProject cvelistV5 (CNA)
Siemens Totally Integrated Automation Portal (TIA Portal) V18 All CVEProject cvelistV5 (CNA)
Siemens Totally Integrated Automation Portal (TIA Portal) V19 All CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2024-12-16
Last updated
2026-01-13
State
Published
Assigner (CNA)
siemens

Exploit prediction (EPSS)

1.51%
Probability of exploitation in 30 days
74.6%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-122
    Heap-based Buffer Overflow