VDB
ICSA-24-256-03
ICSA-24-256-03
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Risk Scores
CVSS v3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Totally Integrated Automation Portal (TIA Portal) V19 | ||
| Totally Integrated Automation Portal (TIA Portal) V18 | ||
| SIMATIC PCS neo V4.0 | ||
| SIMATIC PCS neo V4.1 | ||
| Totally Integrated Automation Portal (TIA Portal) V17 | ||
| Opcenter RDnL | ||
| Opcenter Quality | ||
| Totally Integrated Automation Portal (TIA Portal) V16 | ||
| SINEMA Remote Connect Client | ||
| SINEC NMS | ||
| SIMATIC PCS neo V5.0 |
Timeline
- Sep 10, 2024 CVE Published
- Oct 14, 2025 CVE Updated
References
- https://cert-portal.siemens.com/productcert/csaf/ssa-039007.json advisory
- https://cert-portal.siemens.com/productcert/html/ssa-039007.html advisory
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-256-03.json advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-03 advisory
- https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01 url
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices url
- https://www.cisa.gov/topics/industrial-control-systems url
- https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf url
- https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf url
- https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b url
- https://support.industry.siemens.com/cs/ww/en/view/109784441/ fix
- https://support.industry.siemens.com/cs/ww/en/view/109817218/ fix
- https://support.industry.siemens.com/cs/ww/en/view/109925643/ fix
- https://support.sw.siemens.com/product/297341591/ fix
- https://support.industry.siemens.com/cs/ww/en/view/109976964/ fix
- https://support.industry.siemens.com/cs/ww/en/view/109972354/ fix
- https://support.industry.siemens.com/cs/ww/en/view/109977244/ fix