Riskcovery

CVE-2024-33698

State
Published
Severity
9.3 Critical
Published
Sep 10, 2024
Updated
Oct 14, 2025
Reserved
Apr 26, 2024

Read the record on cve.org

Description

A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions), SINEMA Remote Connect Client (All versions < V3.2 SP3), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 5), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 3). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.

Scores

CVSSScoreVectorSource
4.09.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsiemens
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsiemens

Weaknesses

Affected Products

ProductVersions
Opcenter QualitySiemens
  • before V2406Affected
Opcenter RDnLSiemens
  • before V2410Affected
SIMATIC PCS neo V4.0Siemens
  • all versionsAffected
SIMATIC PCS neo V4.1Siemens
  • before V4.1 Update 2Affected
SIMATIC PCS neo V5.0Siemens
  • before V5.0 Update 1Affected
SINEC NMSSiemens
  • all versionsAffected
SINEMA Remote Connect ClientSiemens
  • before V3.2 SP3Affected
Totally Integrated Automation Portal (TIA Portal) V16Siemens
  • all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V17Siemens
  • before V17 Update 8Affected
Totally Integrated Automation Portal (TIA Portal) V18Siemens
  • before V18 Update 5Affected
Totally Integrated Automation Portal (TIA Portal) V19Siemens
  • before V19 Update 3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.