CVE-2024-49775

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-16 · updated 2026-06-17
Weakness: CWE-122

Description

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions if operated in conjunction with UMC < V2.15), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.

Affected products

Siemens Opcenter Execution Foundation: before V2501.0001 — fixed in V2501.0001
Siemens Opcenter Intelligence: before V2501.0001 — fixed in V2501.0001
Siemens Opcenter Quality: before V2512 — fixed in V2512
Siemens Opcenter RDnL: before V2410 — fixed in V2410
Siemens SIMATIC PCS neo V4.0: all versions
Siemens SIMATIC PCS neo V4.1: before V4.1 Update 3 — fixed in V4.1 Update 3
Siemens SIMATIC PCS neo V5.0: before V5.0 Update 1 — fixed in V5.0 Update 1
Siemens SINEC NMS: all versions
Siemens Totally Integrated Automation Portal (TIA Portal) V16: all versions
Siemens Totally Integrated Automation Portal (TIA Portal) V17: all versions
Siemens Totally Integrated Automation Portal (TIA Portal) V18: all versions
Siemens Totally Integrated Automation Portal (TIA Portal) V19: all versions

How to fix

Upgrade to a fixed version: Siemens Opcenter Execution Foundation V2501.0001; Siemens Opcenter Intelligence V2501.0001; Siemens Opcenter Quality V2512; Siemens Opcenter RDnL V2410; Siemens SIMATIC PCS neo V4.1 V4.1 Update 3; Siemens SIMATIC PCS neo V5.0 V5.0 Update 1. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-928984.html

Get alerted when CVE-2024-49775 or the next vulnerability affects your stack