Heap-based buffer overflow in Siemens Opcenter Quality
Priority MEDIUM 50CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions), SINEMA Remote Connect Client (All versions < V3.2 SP3), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 5), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 3). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01055 64th percentileScored 2026-11-07
Fix Fixed Opcenter Quality (Siemens): V2406Opcenter RDnL (Siemens): V2410+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Opcenter Quality | before V2406 | V2406 | Patch available | CNA |
| Siemens | Opcenter RDnL | before V2410 | V2410 | Patch available | CNA |
| Siemens | SIMATIC PCS neo V4.0 | all versions | — | No fix listed | CNA |
| Siemens | SIMATIC PCS neo V4.1 | before V4.1 Update 2 | V4.1 Update 2 | Patch available | CNA |
| Siemens | SIMATIC PCS neo V5.0 | before V5.0 Update 1 | V5.0 Update 1 | Patch available | CNA |
| Siemens | SINEC NMS | all versions | — | No fix listed | CNA |
| Siemens | SINEMA Remote Connect Client | before V3.2 SP3 | V3.2 SP3 | Patch available | CNA |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V16 | all versions | — | No fix listed | CNA |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V17 | before V17 Update 8 | V17 Update 8 | Patch available | CNA |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V18 | before V18 Update 5 | V18 Update 5 | Patch available | CNA |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V19 | before V19 Update 3 | V19 Update 3 | Patch available | CNA |
- Opcenter Quality VendorSiemens Affected before V2406 Fixed in V2406 Patch available CNA
- Opcenter RDnL VendorSiemens Affected before V2410 Fixed in V2410 Patch available CNA
- SIMATIC PCS neo V4.0 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIMATIC PCS neo V4.1 VendorSiemens Affected before V4.1 Update 2 Fixed in V4.1 Update 2 Patch available CNA
- SIMATIC PCS neo V5.0 VendorSiemens Affected before V5.0 Update 1 Fixed in V5.0 Update 1 Patch available CNA
- SINEC NMS VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SINEMA Remote Connect Client VendorSiemens Affected before V3.2 SP3 Fixed in V3.2 SP3 Patch available CNA
- Totally Integrated Automation Portal (TIA Portal) V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- Totally Integrated Automation Portal (TIA Portal) V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
- Totally Integrated Automation Portal (TIA Portal) V18 VendorSiemens Affected before V18 Update 5 Fixed in V18 Update 5 Patch available CNA
- Totally Integrated Automation Portal (TIA Portal) V19 VendorSiemens Affected before V19 Update 3 Fixed in V19 Update 3 Patch available CNA
CPE names CISA-ADP · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:* | — | — | Siemens |
| cpe:2.3:a:siemens:totally_integrated_automation_portal:16:*:*:*:*:*:*:* | 16 | — | Siemens |
| cpe:2.3:a:siemens:totally_integrated_automation_portal:18:*:*:*:*:*:*:* | 18 | — | Siemens |
| cpe:2.3:a:siemens:totally_integrated_automation_portal:19:*:*:*:*:*:*:* | 19 | — | Siemens |
| cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:* | — | — | Siemens |
| cpe:2.3:a:siemens:simatic_pcs_neo:5.0:*:*:*:*:*:*:* | 5.0 | — | Siemens |
| cpe:2.3:a:siemens:simatic_information_server:2022:*:*:*:*:*:*:* | 2022 | — | Siemens |
| cpe:2.3:a:siemens:simatic_information_server:2024:*:*:*:*:*:*:* | 2024 | — | Siemens |
| cpe:2.3:a:siemens:totally_integrated_automation_portal:17:*:*:*:*:*:*:* | 17 | — | Siemens |
- cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:* Versions — — ·Siemens
- cpe:2.3:a:siemens:totally_integrated_automation_portal:16:*:*:*:*:*:*:* Versions 16 — ·Siemens
- cpe:2.3:a:siemens:totally_integrated_automation_portal:18:*:*:*:*:*:*:* Versions 18 — ·Siemens
- cpe:2.3:a:siemens:totally_integrated_automation_portal:19:*:*:*:*:*:*:* Versions 19 — ·Siemens
- cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:* Versions — — ·Siemens
- cpe:2.3:a:siemens:simatic_pcs_neo:5.0:*:*:*:*:*:*:* Versions 5.0 — ·Siemens
- cpe:2.3:a:siemens:simatic_information_server:2022:*:*:*:*:*:*:* Versions 2022 — ·Siemens
- cpe:2.3:a:siemens:simatic_information_server:2024:*:*:*:*:*:*:* Versions 2024 — ·Siemens
- cpe:2.3:a:siemens:totally_integrated_automation_portal:17:*:*:*:*:*:*:* Versions 17 — ·Siemens
Remediation
- Fix · CNA Opcenter Quality (Siemens) Fixed in V2406
- Fix · CNA Opcenter RDnL (Siemens) Fixed in V2410
- Fix · CNA SIMATIC PCS neo V4.1 (Siemens) Fixed in V4.1 Update 2
- Fix · CNA SIMATIC PCS neo V5.0 (Siemens) Fixed in V5.0 Update 1
- Fix · CNA SINEMA Remote Connect Client (Siemens) Fixed in V3.2 SP3
- Fix · CNA Totally Integrated Automation Portal (TIA Portal) V17 (Siemens) Fixed in V17 Update 8
- Fix · CNA Totally Integrated Automation Portal (TIA Portal) V18 (Siemens) Fixed in V18 Update 5
- Fix · CNA Totally Integrated Automation Portal (TIA Portal) V19 (Siemens) Fixed in V19 Update 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-33698
- 2026-10-03 Alias added: GHSA-5j8g-cmhw-g45p
References
More Siemens vulnerabilities
- TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
- TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2024-33698 · CVE Program
- CVE-2024-33698 · NVD
- FIRST EPSS
- GHSA-5j8g-cmhw-g45p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences