Summary
Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution.
Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 1
-
Critical 9.8
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), S…
Revision history
-
#7
Added remediation for Opcenter RDnL and Opcenter Quality
-
#6
Updated remediation for SINEC NMS to point directly to the update of UMC
-
#5
Added SINEMA Remote Connect Client as affected product including fix
-
#4
Added fix for SIMATIC PCS neo V5.0. Removed SIMATIC Information Server 2022 and SIMATIC Information Server 2024 as not affected
-
#3
Added affected products Opcenter Execution Foundation, Opcenter Quality and Opcenter RDL. Added fix for Totally Integrated Automation Portal (TIA Portal) V18. Clarified no fix planned for product Totally Integrated Automation Portal (TIA Portal) V16
-
#2
Added fix for Totally Integrated Automation Portal (TIA Portal) V19 and clarified formulation for mitigation
-
#1
Publication Date
References
-
SSA-039007: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC) - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-039007.html