#VU105635 Authentication Bypass by Primary Weakness in Siemens products - CVE-2024-42513

Vulnerability identifier: #VU105635

Vulnerability risk: High

CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-42513

CWE-ID: CWE-305

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
SINUMERIK Edge
Server applications / SCADA systems
SIMATIC IPC DiagMonitor
Server applications / SCADA systems
SIMATIC WinCC Unified
Server applications / SCADA systems
SIMATIC BRAUMAT
Other software / Other software solutions
SIMATIC Energy Manager PRO
Other software / Other software solutions
SIMATIC SISTAR
Other software / Other software solutions
Totally Integrated Automation Portal (TIA Portal)
Other software / Other software solutions
SIMATIC WinCC
Hardware solutions / Firmware

Vendor: Siemens

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to insufficient access control in the OPC UA .NET Standard Stack. A remote attacker can bypass application authentication when using HTTPS endpoints.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

SINUMERIK Edge: All versions

SIMATIC BRAUMAT: 8.0 SP1

SIMATIC Energy Manager PRO: 7.2 Update 6 - 7.5

SIMATIC IPC DiagMonitor: All versions

SIMATIC SISTAR: 8.0 SP1

Totally Integrated Automation Portal (TIA Portal): 18 - 19

SIMATIC WinCC: before 8.0

SIMATIC WinCC Unified: before 19

---

External links
https://cert-portal.siemens.com/productcert/txt/ssa-858251.txt

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.