IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-858251: Authentication Bypass Vulnerabilities in OPC UA

CRITICAL
CVSS 9.1
Date 2026-10-13T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

// Vulnerabilities (2)

CVE ID CVSS Score Severity Description
CVE-2024-42513 9.1 critical
CVE-2024-42513. Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
CVE-2024-42512 7.4 high
CVE-2024-42512. Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

// Affected Products (3)

Vendor Product Asset Type Purdue Level Firmware
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--

// Remediations (16)

Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Mitigation: Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by defa
Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default in Unified RT. Systems running with default configuration are therefore not affected by this vulnerability.
Mitigation: Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by defa
Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default. Systems running with default configuration are therefore not affected by this vulnerability.
Patch: Update to V8.0 Update 3 or later version
Update to V8.0 Update 3 or later version
Patch: Update to V7.4 Update 7 or later version
Update to V7.4 Update 7 or later version
Patch: Update to V7.5 Update 2 or later version
Update to V7.5 Update 2 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Mitigation: Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by defa
Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default in Unified RT. Systems running with default configuration are therefore not affected by this vulnerability.
Patch: Update to V7.5 Update 2 or later version
Update to V7.5 Update 2 or later version
Patch: Update to V7.4 Update 7 or later version
Update to V7.4 Update 7 or later version
Patch: Update to V8.0 Update 3 or later version
Update to V8.0 Update 3 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Mitigation: Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by defa
Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default. Systems running with default configuration are therefore not affected by this vulnerability.
Patch: Update to V7.4 Update 7 or later version
Update to V7.4 Update 7 or later version
Patch: Update to V7.4 Update 7 or later version
Update to V7.4 Update 7 or later version
Patch: Update to V7.5 Update 2 or later version
Update to V7.5 Update 2 or later version

// References