Read the docs
TI-2024-28006 Aliases CVE-2024-41986GHSA-fpgf-r359-892c

Broken or risky cryptographic algorithm in Siemens SmartClient modules Opcenter QL Home

Priority LOW 26CWE-327Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-327.

Summary

A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application support insecure TLS 1.0 and 1.1 protocol. An attacker could achieve a man-in-the-middle attack and compromise confidentiality and integrity of data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix Fixed SmartClient modules Opcenter QL Home (SC) (Siemens): V2506SOA Audit (Siemens): V2506+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSmartClient modules Opcenter QL Home (SC)V13.2 to before V2506V2506Patch availableCNA
SiemensSOA AuditV13.2 to before V2506V2506Patch availableCNA
SiemensSOA CockpitV13.2 to before V2506V2506Patch availableCNA
  • SmartClient modules Opcenter QL Home (SC) VendorSiemens Affected V13.2 to before V2506 Fixed in V2506 Patch available CNA
  • SOA Audit VendorSiemens Affected V13.2 to before V2506 Fixed in V2506 Patch available CNA
  • SOA Cockpit VendorSiemens Affected V13.2 to before V2506 Fixed in V2506 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:opcenter_quality:13.2:*:*:*:*:*:*:*13.2VulnerableSiemens
  • cpe:2.3:a:siemens:opcenter_quality:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·Siemens

Remediation

  • Fix · CNA SmartClient modules Opcenter QL Home (SC) (Siemens) Fixed in V2506
  • Fix · CNA SOA Audit (Siemens) Fixed in V2506
  • Fix · CNA SOA Cockpit (Siemens) Fixed in V2506

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SOA Audit, SOA Cockpit, SmartClient modules Opcenter QL Home (SC) V2506

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2024-27999 Incorrect authorization in Siemens SmartClient modules Opcenter QL HomePriority LOW 32
    • TI-2024-28002 A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All…Priority LOW 25
    • TI-2024-28003 Information disclosure through error messages in Siemens SmartClient modules Opcenter QL…Priority LOW 23
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41986
  2. 2026-10-03 Alias added: GHSA-fpgf-r359-892c

References

Advisory 1

  • TI-2021-08882 A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS… CVSS 3.1CRITICAL 9.8
  • TI-2023-24902 A vulnerability has been identified in Opcenter Execution Foundation (All versions <… CVSS 3.1HIGH 8.8
  • TI-2023-24906 Improper input validation in Siemens Opcenter Execution Foundation CVSS 3.1HIGH 7.5
  • TI-2023-24905 Buffer overflow in Siemens Opcenter Execution Foundation CVSS 3.1HIGH 7.5
  • TI-2020-06109 Uncontrolled resource consumption in Siemens Opcenter Execution Discrete CVSS 3.1HIGH 8.2
  • TI-2022-14854 Improper authentication in Siemens Opcenter Quality V13.1 CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences