SSA-858251

Vulnerability from csaf_siemens - Published: 2025-03-11 00:00 - Updated: 2026-10-13 00:00
Summary
SSA-858251: Authentication Bypass Vulnerabilities in OPC UA
Notes
Summary: The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use: The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
CVE-2024-42512

Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-208 - Observable Timing Discrepancy
Affected products
Product Identifier Version Remediation
SIMIT V11 < V11.3
Siemens / SIMIT V11
 vers:intdot/<11.3
Vendor Fix fix
SIMATIC Energy Manager PRO V7.2
Siemens / SIMATIC Energy Manager PRO V7.2
 vers:all/*
No Fix Planned
SIMATIC Energy Manager PRO V7.3
Siemens / SIMATIC Energy Manager PRO V7.3
 vers:all/*
No Fix Planned
SIMATIC Energy Manager PRO V7.4 >= V7.4 Update 0 < V7.4 Update 7
Siemens / SIMATIC Energy Manager PRO V7.4
 vers:intdot/>=7.4.0.0|<7.4.0.7
Vendor Fix fix
SIMATIC Energy Manager PRO V7.5 >= V7.5 Update 0 < V7.5 Update 2
Siemens / SIMATIC Energy Manager PRO V7.5
 vers:intdot/>=7.5.0.0|<7.5.0.2
Vendor Fix fix
CVE-2024-42513

Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-305 - Authentication Bypass by Primary Weakness
Affected products
Product Identifier Version Remediation
Industrial Edge for Machine Tools (formerly known as "SINUMERIK Edge")
Siemens / Industrial Edge for Machine Tools (formerly known as "SINUMERIK Edge")
 vers:all/*
No Fix Planned
SIMATIC WinCC Unified V19 < V19 Update 4
Siemens / SIMATIC WinCC Unified V19
 vers:intdot/<19.0.4
Mitigation
Vendor Fix fix
SIMATIC WinCC V8.0 < V8.0 Update 3
Siemens / SIMATIC WinCC V8.0
 vers:intdot/<8.0.0.3
Vendor Fix fix
SIMATIC Energy Manager PRO V7.2
Siemens / SIMATIC Energy Manager PRO V7.2
 vers:all/*
No Fix Planned
SIMATIC Energy Manager PRO V7.3
Siemens / SIMATIC Energy Manager PRO V7.3
 vers:all/*
No Fix Planned
SIMATIC Energy Manager PRO V7.4 >= V7.4 Update 0 < V7.4 Update 7
Siemens / SIMATIC Energy Manager PRO V7.4
 vers:intdot/>=7.4.0.0|<7.4.0.7
Vendor Fix fix
SIMATIC Energy Manager PRO V7.5 >= V7.5 Update 0 < V7.5 Update 2
Siemens / SIMATIC Energy Manager PRO V7.5
 vers:intdot/>=7.5.0.0|<7.5.0.2
Vendor Fix fix
SIMATIC IPC DiagMonitor
Siemens / SIMATIC IPC DiagMonitor
 vers:all/*
Mitigation
No Fix Planned
SIMATIC WinCC Unified V18 < V18 Update 6
Siemens / SIMATIC WinCC Unified V18
 vers:intdot/<18.0.6
Mitigation
Vendor Fix fix
Product Identifier Version Remediation
SIMATIC BRAUMAT
Siemens / SIMATIC BRAUMAT
 vers:all/*
SIMATIC SISTAR
Siemens / SIMATIC SISTAR
 vers:all/*
Threats
Impact The product does not expose an HTTPS endpoint.
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-858251: Authentication Bypass Vulnerabilities in OPC UA - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html"
      },
      {
        "category": "self",
        "summary": "SSA-858251: Authentication Bypass Vulnerabilities in OPC UA - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-858251.json"
      }
    ],
    "title": "SSA-858251: Authentication Bypass Vulnerabilities in OPC UA",
    "tracking": {
      "current_release_date": "2026-10-13T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-858251",
      "initial_release_date": "2025-03-11T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-03-11T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2025-06-10T00:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added fix for  SIMIT V11; Clarified that SIMATIC BRAUMAT and SIMATIC SISTAR are not affected by CVE-2024-42513"
        },
        {
          "date": "2026-10-13T00:00:00.000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added Fix version for  SIMATIC WinCC Unified V18"
        }
      ],
      "status": "interim",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Industrial Edge for Machine Tools (formerly known as \"SINUMERIK Edge\")",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge for Machine Tools (formerly known as \"SINUMERIK Edge\")"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC BRAUMAT",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC BRAUMAT"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC Energy Manager PRO V7.2",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Energy Manager PRO V7.2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC Energy Manager PRO V7.3",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Energy Manager PRO V7.3"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003e=7.4.0.0|\u003c7.4.0.7",
                "product": {
                  "name": "SIMATIC Energy Manager PRO V7.4 \u003e= V7.4 Update 0 \u003c V7.4 Update 7",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Energy Manager PRO V7.4"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003e=7.5.0.0|\u003c7.5.0.2",
                "product": {
                  "name": "SIMATIC Energy Manager PRO V7.5 \u003e= V7.5 Update 0 \u003c V7.5 Update 2",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Energy Manager PRO V7.5"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC IPC DiagMonitor",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC DiagMonitor"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC SISTAR",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC SISTAR"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c18.0.6",
                "product": {
                  "name": "SIMATIC WinCC Unified V18 \u003c V18 Update 6",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC Unified V18"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c19.0.4",
                "product": {
                  "name": "SIMATIC WinCC Unified V19 \u003c V19 Update 4",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC Unified V19"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c8.0.0.3",
                "product": {
                  "name": "SIMATIC WinCC V8.0 \u003c V8.0 Update 3",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC V8.0"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c11.3",
                "product": {
                  "name": "SIMIT V11 \u003c V11.3",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMIT V11"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-42512",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "12",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "3",
            "4"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V11.3 or later version",
          "product_ids": [
            "12"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109987184/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V7.4 Update 7 or later version",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109997044/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V7.5 Update 2 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109996728/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "12",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2024-42512"
    },
    {
      "cve": "CVE-2024-42513",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "flags": [
        {
          "label": "vulnerable_code_not_in_execute_path",
          "product_ids": [
            "2",
            "8"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "10",
          "11",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9"
        ],
        "known_not_affected": [
          "2",
          "8"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default in Unified RT. Systems running with default configuration are therefore not affected by this vulnerability.",
          "product_ids": [
            "10",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default. Systems running with default configuration are therefore not affected by this vulnerability.",
          "product_ids": [
            "7"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "1",
            "3",
            "4",
            "7"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V18 Update 6 or later version",
          "product_ids": [
            "9"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109817218/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V19 Update 4 or later version",
          "product_ids": [
            "10"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109925643/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V7.4 Update 7 or later version",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109997044/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V7.5 Update 2 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109996728/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V8.0 Update 3 or later version",
          "product_ids": [
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109818723/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "10",
            "11",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "The product does not expose an HTTPS endpoint.",
          "product_ids": [
            "2",
            "8"
          ]
        }
      ],
      "title": "CVE-2024-42513"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.