A critical vulnerability has been identified in Siemens’ User Management Component (UMC), which could allow unauthenticated remote attackers to execute arbitrary code.
The flaw, designated CVE-2024-49775, is a heap-based buffer overflow vulnerability. Siemens has issued Security Advisory SSA-928984 and urges customers to implement recommended fixes or mitigations to minimize the risks.
The vulnerability affects multiple Siemens products integrated with the UMC component, allowing remote attackers to execute arbitrary code that could jeopardize the confidentiality, integrity, and availability of affected systems.
Rated as critical, the flaw carries a CVSS v3.1 Base Score of 9.8 and a CVSS v4.0 Base Score of 9.3.
Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free
Classified under CWE-122: Heap-Based Buffer Overflow, the issue stems from improper memory handling and poses significant risks to operational systems.
Siemens has credited Tenable for its role in the coordinated disclosure of this vulnerability.
Affected Products and Solutions
The following table provides an overview of affected products, their vulnerability status, and available mitigations.
| Product | Version | CVE ID | Remediation |
| Opcenter Execution Foundation | All versions | CVE-2024-49775 | No fix available. Follow recommendations in Workarounds and Mitigations. |
| Opcenter Intelligence | All versions | CVE-2024-49775 | No fix available. Follow recommendations in Workarounds and Mitigations. |
| Opcenter Quality | All versions | CVE-2024-49775 | No fix available. Follow recommendations in Workarounds and Mitigations. |
| Opcenter RDL | All versions | CVE-2024-49775 | No fix available. Follow recommendations in Workarounds and Mitigations. |
| SINEC NMS | UMC < V2.15 | CVE-2024-49775 | Update SINEC NMS to V3.0 SP2 or later and UMC to V2.15 or later. Contact Siemens support. |
| Totally Integrated Automation Portal (TIA Portal) | Open for details | CVE-2024-49775 | Fixed versions available; see Siemens support documentation for details. |
Siemens emphasizes strict adherence to industrial security guidelines and general network protection best practices.
This critical vulnerability underscores the importance of regular patch management and proactive threat mitigation in industrial environments.
2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide
Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect…
A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing how…
EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of operational…
A sophisticated phishing campaign, dubbed "PoisonSeed," has been identified targeting customer relationship management (CRM) and…
A surge in phishing text messages claiming unpaid tolls has been linked to a massive…
The State Bar of Texas has confirmed a data breach following the detection of unauthorized…