CyberSecBulletin
CVE-2024-42512NVD status: Modified

SIMATIC Energy Manager PRO V7.2: Observable Timing Discrepancy

Published Updated By the CyberSecBulletin desk

CVE-2024-42512 is a high-severity observable timing discrepancy vulnerability in SIMATIC Energy Manager PRO V7.2 from Siemens, with a CVSS 3.1 base score of 8.6 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected SIMATIC Energy Manager PRO V7.2 versions: all versions. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.59% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update SIMATIC Energy Manager PRO V7.4 to V7.4 Update 7 or a later version.
  2. Update SIMATIC Energy Manager PRO V7.5 to V7.5 Update 2 or a later version.
  3. Update SIMIT V11 to V11.3 or a later version.
  4. Read the advisory on files.opcfoundation.org for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
SiemensSIMATIC Energy Manager PRO V7.2all versionsNot stated
SiemensSIMATIC Energy Manager PRO V7.3all versionsNot stated
SiemensSIMATIC Energy Manager PRO V7.4V7.4 Update 0 up to, but not including, V7.4 Update 7V7.4 Update 7
SiemensSIMATIC Energy Manager PRO V7.5V7.5 Update 0 up to, but not including, V7.5 Update 2V7.5 Update 2
SiemensSIMIT V11before V11.3V11.3
OpcfoundationUa .net Standard Stackbefore 1.5.374.1581.5.374.158

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
LowLimited modification of data is possible.
Availability
LowPerformance or availability is reduced.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. Scored by CISA (ADP).

Official description

Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

More Observable Timing Discrepancy vulnerabilities (CWE-208)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Observable Timing Discrepancy vulnerabilities

Spotted an error? Tell us.