Description
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMIT V10 (All versions), SIMIT V11 (All versions < V11.1). Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in Siemens products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIMATIC Energy Manager Basic | < V7.5 | V7.5 |
| Siemens | SIMATIC Energy Manager PRO | < V7.5 | V7.5 |
| Siemens | SIMATIC IPC DiagBase | — | — |
| Siemens | SIMATIC IPC DiagMonitor | — | — |
| Siemens | SIMIT V10 | — | — |
| Siemens | SIMIT V11 | < V11.1 | V11.1 |
Advisories 3
- ICSA-24-193-07 Siemens SIMATIC and SIMIT CISA ICS & IT advisories · May 6, 2025
- SSA-088132 SSA-088132: Denial of Service Vulnerability in the OPC UA Server Implementations of Several Industrial Products Siemens ProductCERT · Sep 10, 2024
- NCSC-2024-0282 Kwetsbaarheden verholpen in Siemens Producten NCSC-NL (Netherlands) · Jul 9, 2024