Read the docs
TI-2024-27999 Aliases CVE-2024-41979GHSA-xppg-xx55-6rw5

Incorrect authorization in Siemens SmartClient modules Opcenter QL Home

Priority LOW 32CWE-863Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application does not enforce mandatory authorization on some functionality level at server side. This could allow an authenticated attacker to gain complete access of the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed SmartClient modules Opcenter QL Home (SC) (Siemens): V2506SOA Audit (Siemens): V2506+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSmartClient modules Opcenter QL Home (SC)V13.2 to before V2506V2506Patch availableCNA
SiemensSOA AuditV13.2 to before V2506V2506Patch availableCNA
SiemensSOA CockpitV13.2 to before V2506V2506Patch availableCNA
  • SmartClient modules Opcenter QL Home (SC) VendorSiemens Affected V13.2 to before V2506 Fixed in V2506 Patch available CNA
  • SOA Audit VendorSiemens Affected V13.2 to before V2506 Fixed in V2506 Patch available CNA
  • SOA Cockpit VendorSiemens Affected V13.2 to before V2506 Fixed in V2506 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:opcenter_quality:13.2:*:*:*:*:*:*:*13.2VulnerableSiemens
  • cpe:2.3:a:siemens:opcenter_quality:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·Siemens

Remediation

  • Fix · CNA SmartClient modules Opcenter QL Home (SC) (Siemens) Fixed in V2506
  • Fix · CNA SOA Audit (Siemens) Fixed in V2506
  • Fix · CNA SOA Cockpit (Siemens) Fixed in V2506

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SOA Audit, SOA Cockpit, SmartClient modules Opcenter QL Home (SC) V2506

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2024-28006 Broken or risky cryptographic algorithm in Siemens SmartClient modules Opcenter QL HomePriority LOW 26
    • TI-2024-28002 A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All…Priority LOW 25
    • TI-2024-28003 Information disclosure through error messages in Siemens SmartClient modules Opcenter QL…Priority LOW 23
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41979
  2. 2026-10-03 Alias added: GHSA-xppg-xx55-6rw5

References

Advisory 1

  • TI-2021-08882 A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS… CVSS 3.1CRITICAL 9.8
  • TI-2023-24902 A vulnerability has been identified in Opcenter Execution Foundation (All versions <… CVSS 3.1HIGH 8.8
  • TI-2023-24906 Improper input validation in Siemens Opcenter Execution Foundation CVSS 3.1HIGH 7.5
  • TI-2023-24905 Buffer overflow in Siemens Opcenter Execution Foundation CVSS 3.1HIGH 7.5
  • TI-2020-06109 Uncontrolled resource consumption in Siemens Opcenter Execution Discrete CVSS 3.1HIGH 8.2
  • TI-2022-14854 Improper authentication in Siemens Opcenter Quality V13.1 CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences