Siemens UMC Heap Overflow Vulnerability (CVE-2024-33698) Security Advisory

Key Information Vulnerability Description Vulnerability Type: Heap-based Buffer Overflow Affected Component: User Management Component (UMC) Vulnerability ID: SSA-039007 CVSS v3.1 Base Score: 9.8 CVSS v4.0 Base Score: 9.3 Affected Products SIMATIC Information Server SIMATIC PCS neo SINEC NMS Totally Integrated Automation Portal (TIA Portal) Remediation SIMATIC Information Server: No fix available at this time. Refer to the "Exploitation and Mitigation" section. SIMATIC PCS neo: See details. Refer to the "Exploitation and Mitigation" section. SINEC NMS: Upgrade UMC to V2.11.6. Contact customer support for patch and update information. Refer to the "Exploitation and Mitigation" section. Totally Integrated Automation Portal (TIA Portal): See details. Refer to the "Exploitation and Mitigation" section. Exploitation and Mitigation CVE-2024-33698: - Mitigation: - Filter ports 4002 and 4004 to only accept connections from IP addresses of machines running UMC. - If no real-time server machine is present, port 4004 can be fully filtered. General Security Recommendations Recommendations: - Configure your environment in accordance with Siemens’ Industrial Security Operational Guidelines. - Follow recommendations in the product manuals. - For more information, visit https://www.siemens.com/industrialsecurity. Product Description Products: SIMATIC Information Server, SIMATIC PCS neo, SINEC NMS, Totally Integrated Automation Portal (TIA Portal) Additional Information Contact Information: For further inquiries regarding security vulnerabilities in Siemens products and solutions, contact Siemens ProductCERT: https://www.siemens.com/cert/advisories Historical Data Version: V1.0 (2024-09-10): Release Date Terms and Usage Terms: Siemens Security Advisories are subject to Siemens’ license terms or any other applicable agreements previously entered into with Siemens. Where applicable, the terms of the Siemens Security Advisory, the terms of use of the Siemens global website (https://www.siemens.com/terms_of_use), and Sections 8–10 of the Terms of Use shall apply. In case of conflict, the license terms shall take precedence over the Terms of Use.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens UMC Heap Overflow Vulnerability (CVE-2024-33698) Security Advisory