Skip to content
OpenAdvisories
Critical ICSA-25-072-09 2 CVEs

Siemens OPC UA

Published Mar 11, 2025 · Updated Jan 14, 2026 · Revision 4

Vendor: Siemens Product: Industrial Edge for Machine Tools (formerly known as "SINUMERIK Edge") Product: SIMATIC BRAUMAT Product: SIMATIC Energy Manager PRO V7.2 Product: SIMATIC Energy Manager PRO V7.3 Product: SIMATIC Energy Manager PRO V7.4 Product: SIMATIC Energy Manager PRO V7.5 Product: SIMATIC IPC DiagMonitor Product: SIMATIC SISTAR Product: SIMATIC WinCC Unified V18 Product: SIMATIC WinCC Unified V19 Product: SIMATIC WinCC V8.0 Product: SIMIT V11

Summary

The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 2

  • High 8.6
    CVE-2024-42512

    Security Update for the OPC UA .NET Standard Stack

    Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

    OPCFoundation.NetStandard.Opc.Ua.Core NuGet
  • Medium 5.3
    CVE-2024-42513

    Security Update for the OPC UA .NET Standard Stack

    Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.

    OPCFoundation.NetStandard.Opc.Ua.Bindings.Https NuGet

Revision history

  1. #4

    Initial Republication of Siemens ProductCERT SSA-858251 advisory

  2. #3

    Automatically generated entry

  3. #2

    Added fix for SIMIT V11; Clarified that SIMATIC BRAUMAT and SIMATIC SISTAR are not affected by CVE-2024-42513

  4. #1

    Publication Date

References