High severity · published Feb 10, 2025
CVE-2024-42512
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security…
8.6
CVSS
0.6%
EPSS
No
On KEV
Description
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
UA .net Standard Stack · Opcfoundation
before 1.5.374.158 · source: NVD
SE
SIMATIC Energy Manager PRO V7.2 · Siemens
0 · source: CISA
SE
SIMATIC Energy Manager PRO V7.3 · Siemens
0 · source: CISA
SE
SIMATIC Energy Manager PRO V7.4 · Siemens
V7.4 Update 0 before V7.4 Update 7 · source: CISA
SE
SIMATIC Energy Manager PRO V7.5 · Siemens
V7.5 Update 0 before V7.5 Update 2 · source: CISA
SV
SIMIT V11 · Siemens
before V11.3 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42512
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42512
Vendor Advisory
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42512.pdf
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-858251.html
More from UA .net Standard Stack
7.5
CVE-2022-33916
OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information
7.5
CVE-2022-29866
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resource Consumption
7.5
CVE-2022-29864
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consumption
7.5
CVE-2022-29863
OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation
7.5
CVE-2022-29865
OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials