Skip to content
OpenAdvisories
Critical SSA-928984 1 CVE

SSA-928984: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)

Published Dec 16, 2024 · Updated Jan 13, 2026 · Revision 5

Vendor: Siemens Product: Desigo ABT Product: Opcenter Execution Foundation Product: Opcenter Intelligence Product: Opcenter Quality Product: Opcenter RDnL Product: SIMATIC PCS neo V4.0 Product: SIMATIC PCS neo V4.1 Product: SIMATIC PCS neo V5.0 Product: SINEC NMS Product: Totally Integrated Automation Portal (TIA Portal) V16 Product: Totally Integrated Automation Portal (TIA Portal) V17 Product: Totally Integrated Automation Portal (TIA Portal) V18 Product: Totally Integrated Automation Portal (TIA Portal) V19

Summary

Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #5

    Added fix for Opcenter Quality

  2. #4

    Added fix for Opcenter Execution Foundation, Opcenter Intelligence and Opcenter RDnL

  3. #3

    Added remediation for Totally Integrated Automation Portal (TIA Portal) V17, V18 and V19. Updated remediation for SINEC NMS to point directly to the update of UMC

  4. #2

    Added fix for SIMATIC PCS neo V4.1

  5. #1

    Publication Date

References