by Kastro
Paper/Archive/CVE-2024-49775

CVE-2024-49775

Siemens Opcenter Execution Foundation — A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.3.743 × 2014.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions if operated in conjunction with UMC < V2.15), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.

Affected

ProductAffectedFixed inSource
Opcenter Execution Foundation< V2501.0001V2501.0001CNA
Opcenter Intelligence< V2501.0001V2501.0001CNA
Opcenter Quality< V2512V2512CNA
Opcenter RDnL< V2410V2410CNA
SIMATIC PCS neo V4.0all versions–CNA
SIMATIC PCS neo V4.1< V4.1 Update 3V4.1 Update 3CNA
SIMATIC PCS neo V5.0< V5.0 Update 1V5.0 Update 1CNA
SINEC NMSall versions–CNA
Totally Integrated Automation Portal (TIA Portal) V16all versions–CNA
Totally Integrated Automation Portal (TIA Portal) V17all versions–CNA
Totally Integrated Automation Portal (TIA Portal) V18all versions–CNA
Totally Integrated Automation Portal (TIA Portal) V19all versions–CNA

Scores by source

siemens (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
siemens (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert-portal.siemens.com/productcert/html/ssa-928984.html