Read the docs
TI-2024-29679 Aliases CVE-2024-44102GHSA-57qc-q8rc-w8h7

Deserialization of untrusted data in Siemens PP TeleControl Server Basic 1000 to 5000 V3.1

Priority MEDIUM 51CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 256 to 1000 V3.1 (6NH9910-0AA31-0AD1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 32 to 64 V3.1 (6NH9910-0AA31-0AF1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 64 to 256 V3.1 (6NH9910-0AA31-0AC1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 8 to 32 V3.1 (6NH9910-0AA31-0AB1) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 1000 V3.1 (6NH9910-0AA31-0AD0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 256 V3.1 (6NH9910-0AA31-0AC0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 32 V3.1 (6NH9910-0AA31-0AF0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 5000 V3.1 (6NH9910-0AA31-0AE0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 64 V3.1 (6NH9910-0AA31-0AB0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 8 V3.1 (6NH9910-0AA31-0AA0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic Serv Upgr (6NH9910-0AA31-0GA1) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic Upgr V3.1 (6NH9910-0AA31-0GA0) (All versions < V3.1.2.1 with redundancy configured). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00996 62nd percentileScored 2026-11-07
Fix Fixed PP TeleControl Server Basic 1000 to 5000 V3.1 (Siemens): V3.1.2.1PP TeleControl Server Basic 256 to 1000 V3.1 (Siemens): V3.1.2.1+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensPP TeleControl Server Basic 1000 to 5000 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensPP TeleControl Server Basic 256 to 1000 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensPP TeleControl Server Basic 32 to 64 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensPP TeleControl Server Basic 64 to 256 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensPP TeleControl Server Basic 8 to 32 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensTeleControl Server Basic 1000 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensTeleControl Server Basic 256 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensTeleControl Server Basic 32 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensTeleControl Server Basic 5000 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensTeleControl Server Basic 64 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensTeleControl Server Basic 8 V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
SiemensTeleControl Server Basic Serv Upgrbefore V3.1.2.1V3.1.2.1Patch availableCNA
SiemensTeleControl Server Basic Upgr V3.1before V3.1.2.1V3.1.2.1Patch availableCNA
  • PP TeleControl Server Basic 1000 to 5000 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • PP TeleControl Server Basic 256 to 1000 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • PP TeleControl Server Basic 32 to 64 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • PP TeleControl Server Basic 64 to 256 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • PP TeleControl Server Basic 8 to 32 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • TeleControl Server Basic 1000 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • TeleControl Server Basic 256 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • TeleControl Server Basic 32 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • TeleControl Server Basic 5000 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • TeleControl Server Basic 64 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • TeleControl Server Basic 8 V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • TeleControl Server Basic Serv Upgr VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA
  • TeleControl Server Basic Upgr V3.1 VendorSiemens Affected before V3.1.2.1 Fixed in V3.1.2.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:*3.1 to before 3.1.2.1VulnerableSiemens
  • cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:* Versions 3.1 to before 3.1.2.1 Vulnerable ·Siemens

Remediation

  • Fix · CNA PP TeleControl Server Basic 1000 to 5000 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA PP TeleControl Server Basic 256 to 1000 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA PP TeleControl Server Basic 32 to 64 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA PP TeleControl Server Basic 64 to 256 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA PP TeleControl Server Basic 8 to 32 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA TeleControl Server Basic 1000 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA TeleControl Server Basic 256 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA TeleControl Server Basic 32 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA TeleControl Server Basic 5000 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA TeleControl Server Basic 64 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA TeleControl Server Basic 8 V3.1 (Siemens) Fixed in V3.1.2.1
  • Fix · CNA TeleControl Server Basic Serv Upgr (Siemens) Fixed in V3.1.2.1
  • Fix · CNA TeleControl Server Basic Upgr V3.1 (Siemens) Fixed in V3.1.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-44102
  2. 2026-10-03 Alias added: GHSA-57qc-q8rc-w8h7

References

Patch 1

  • TI-2025-20369 SQL injection in Siemens TeleControl Server Basic CVSS 4.0CRITICAL 9.3
  • TI-2025-20368 SQL injection in Siemens TeleControl Server Basic CVSS 4.0CRITICAL 9.3
  • TI-2025-20330 SQL injection in Siemens TeleControl Server Basic CVSS 4.0CRITICAL 9.3
  • TI-2019-04628 Improper handling of exceptional conditions in Siemens SIMATIC CP 443-1 OPC UA CVSS 3.1HIGH 7.5
  • TI-2018-03413 Improper authentication in Siemens TeleControl Server Basic CVSS 3.0HIGH 8.8
  • TI-2025-27227 Missing authentication in Siemens TeleControl Server Basic V3.1 CVSS 4.0CRITICAL 9.3
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences