Threat Investigation
Request a demo

CVE-2024-33698

Critical

Description

A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions), SINEMA Remote Connect Client (All versions < V3.2 SP3), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 5), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 3). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.

SeverityCritical
CVSS9.8
Exploit probability—
ProductOpcenter Quality
PublishedSep 10, 2024
First seenSep 10, 2024
Weakness typeCWE-122CWE-122

How to fix

Update
  • Siemens Opcenter QualityV2406 or later
  • Siemens Opcenter RDnLV2410 or later
  • Siemens SIMATIC PCS neo V4.1V4.1 Update 2 or later
  • Siemens SIMATIC PCS neo V5.0V5.0 Update 1 or later
  • Siemens SINEMA Remote Connect ClientV3.2 SP3 or later
  • Siemens Totally Integrated Automation Portal (TIA Portal) V17V17 Update 8 or later
  • Siemens Totally Integrated Automation Portal (TIA Portal) V18V18 Update 5 or later
  • Siemens Totally Integrated Automation Portal (TIA Portal) V19V19 Update 3 or later

Affected products

ProductAffected versionsFixed in
Siemens Opcenter Qualityv < V2406V2406
Siemens Opcenter RDnLv < V2410V2410
Siemens SIMATIC PCS neo V4.00—
Siemens SIMATIC PCS neo V4.1v < V4.1 Update 2V4.1 Update 2
Siemens SIMATIC PCS neo V5.0v < V5.0 Update 1V5.0 Update 1
Siemens SINEC NMS0—
Siemens SINEMA Remote Connect Clientv < V3.2 SP3V3.2 SP3
Siemens Totally Integrated Automation Portal (TIA Portal) V160—
Siemens Totally Integrated Automation Portal (TIA Portal) V17v < V17 Update 8V17 Update 8
Siemens Totally Integrated Automation Portal (TIA Portal) V18v < V18 Update 5V18 Update 5
Siemens Totally Integrated Automation Portal (TIA Portal) V19v < V19 Update 3V19 Update 3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.