CVE-2024-49775

published 2024-12-16

CVE-2024-49775: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter…

critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions if operated in conjunction with UMC < V2.15), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component.
This could allow an unauthenticated remote attacker to execute arbitrary code.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
siemens	opcenter_execution_foundation	< V2501.0001	V2501.0001
siemens	opcenter_intelligence	< V2501.0001	V2501.0001
siemens	opcenter_quality	< V2512	V2512
siemens	opcenter_rdnl	< V2410	V2410
siemens	simatic_pcs_neo_v4.0	< *	*
siemens	simatic_pcs_neo_v4.1	< V4.1 Update 3	V4.1 Update 3
siemens	simatic_pcs_neo_v5.0	< V5.0 Update 1	V5.0 Update 1
siemens	sinec_nms	< *	*
siemens	totally_integrated_automation_portal_v16	< *	*
siemens	totally_integrated_automation_portal_v17	< *	*
siemens	totally_integrated_automation_portal_v18	< *	*
siemens	totally_integrated_automation_portal_v19	< *	*

CWE-122