PT-2024-6147 · Siemens · Sinec Nms+6

Published 2024-09-10 · Updated 2025-10-17 · CVE-2024-33698

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC Information Server versions 2022 and 2024 SIMATIC PCS neo versions 4.0, 4.1 through 4.1 Update 2, and 5.0 SINEC NMS versions prior to the fixed version Totally Integrated Automation Portal (TIA Portal) versions 16, 17 through 17 Update 8, 18, and 19 through 19 Update 3 Opcenter Execution Foundation versions prior to the fixed version Opcenter Quality versions prior to the fixed version Opcenter RDL versions prior to the fixed version

Description The issue is related to a heap-based buffer overflow vulnerability in the integrated User Management Component (UMC) of various Siemens products. This could allow an unauthenticated remote attacker to execute arbitrary code. The vulnerability is considered critical and may have a significant impact on industrial control systems.

Recommendations For SIMATIC Information Server versions 2022 and 2024, update to a version that includes the fix for this vulnerability. For SIMATIC PCS neo version 4.0, update to a version that includes the fix for this vulnerability. For SIMATIC PCS neo version 4.1, update to version 4.1 Update 2 or later. For SIMATIC PCS neo version 5.0, update to a version that includes the fix for this vulnerability. For SINEC NMS, update to a version that includes the fix for this vulnerability. For Totally Integrated Automation Portal (TIA Portal) version 16, update to a version that includes the fix for this vulnerability. For Totally Integrated Automation Portal (TIA Portal) version 17, update to version 17 Update 8 or later. For Totally Integrated Automation Portal (TIA Portal) version 18, update to a version that includes the fix for this vulnerability. For Totally Integrated Automation Portal (TIA Portal) version 19, update to version 19 Update 3 or later. For Opcenter Execution Foundation, update to a version that includes the fix for this vulnerability. For Opcenter Quality, update to a version that includes the fix for this vulnerability. For Opcenter RDL, update to a version that includes the fix for this vulnerability.

Fix

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2024-07066

CVE-2024-33698

Affected Products

Opcenter Execution Foundation

Opcenter Quality

Opcenter Rd&L

Simatic Information Server

Simatic Pcs Neo

Sinec Nms

Totally Integrated Automation Portal

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2024-33698 · Security Note
• https://bdu.fstec.ru/vul/2024-07066 · Security Note
• https://twitter.com/CveFindCom/status/1833446070099021877 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-039007.html · Note
• https://twitter.com/CrowdCyber_Com/status/1833566550072131747 · Twitter Post
• https://twitter.com/CVEnew/status/1833443216445559283 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1833498833327710564 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1833452362142195815 · Twitter Post
• https://twitter.com/cracbot/status/1834834565527224824 · Twitter Post
• https://twitter.com/cracbot/status/1835196928042402093 · Twitter Post
• https://twitter.com/vuldb/status/1833474643325555115 · Twitter Post
• https://twitter.com/ohhara_shiojiri/status/1833760615384633555 · Twitter Post
• https://twitter.com/fletch_ai/status/1833762508538306800 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1979273196818891152 · Twitter Post
• https://t.me/pentestingnews/51233 · Telegram Post