Threat Investigation
Request a demo

CVE-2024-49775

Critical

Description

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions if operated in conjunction with UMC < V2.15), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.

SeverityCritical
CVSS9.8
Exploit probability—
ProductOpcenter Execution Foundation
PublishedDec 16, 2024
First seenDec 16, 2024
Weakness typeCWE-122CWE-122

How to fix

Update
  • Siemens Opcenter Execution FoundationV2501.0001 or later
  • Siemens Opcenter IntelligenceV2501.0001 or later
  • Siemens Opcenter QualityV2512 or later
  • Siemens Opcenter RDnLV2410 or later
  • Siemens SIMATIC PCS neo V4.1V4.1 Update 3 or later
  • Siemens SIMATIC PCS neo V5.0V5.0 Update 1 or later

Affected products

ProductAffected versionsFixed in
Siemens Opcenter Execution Foundationv < V2501.0001V2501.0001
Siemens Opcenter Intelligencev < V2501.0001V2501.0001
Siemens Opcenter Qualityv < V2512V2512
Siemens Opcenter RDnLv < V2410V2410
Siemens SIMATIC PCS neo V4.00—
Siemens SIMATIC PCS neo V4.1v < V4.1 Update 3V4.1 Update 3
Siemens SIMATIC PCS neo V5.0v < V5.0 Update 1V5.0 Update 1
Siemens SINEC NMS0—
Siemens Totally Integrated Automation Portal (TIA Portal) V160—
Siemens Totally Integrated Automation Portal (TIA Portal) V170—
Siemens Totally Integrated Automation Portal (TIA Portal) V180—
Siemens Totally Integrated Automation Portal (TIA Portal) V190—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.