Skip to content
OpenAdvisories
Critical SSA-858251 2 CVEs

SSA-858251: Authentication Bypass Vulnerabilities in OPC UA

Published Mar 11, 2025 · Updated Oct 13, 2026 · Revision 3

Vendor: Siemens Product: Industrial Edge for Machine Tools (formerly known as "SINUMERIK Edge") Product: SIMATIC BRAUMAT Product: SIMATIC Energy Manager PRO V7.2 Product: SIMATIC Energy Manager PRO V7.3 Product: SIMATIC Energy Manager PRO V7.4 Product: SIMATIC Energy Manager PRO V7.5 Product: SIMATIC IPC DiagMonitor Product: SIMATIC SISTAR Product: SIMATIC WinCC Unified V18 Product: SIMATIC WinCC Unified V19 Product: SIMATIC WinCC V8.0 Product: SIMIT V11

Summary

The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 2

  • High 8.6
    CVE-2024-42512

    Security Update for the OPC UA .NET Standard Stack

    Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

    OPCFoundation.NetStandard.Opc.Ua.Core NuGet
  • Medium 5.3
    CVE-2024-42513

    Security Update for the OPC UA .NET Standard Stack

    Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.

    OPCFoundation.NetStandard.Opc.Ua.Bindings.Https NuGet

Revision history

  1. #3

    Added Fix version for SIMATIC WinCC Unified V18

  2. #2

    Added fix for SIMIT V11; Clarified that SIMATIC BRAUMAT and SIMATIC SISTAR are not affected by CVE-2024-42513

  3. #1

    Publication Date

References