CVE-2024-42512

Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42512.pdf	Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-858251.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:opcfoundation:ua_.net_standard_stack:*:*:*:*:*:*:*:*

History

15 Oct 2026, 01:18

Type	Values Removed	Values Added
References		() https://cert-portal.siemens.com/productcert/html/ssa-858251.html -

Information

Published : 2025-02-10 19:15

Updated : 2026-10-15 01:18

NVD link : CVE-2024-42512

Mitre link : CVE-2024-42512

CVE.ORG link : CVE-2024-42512

JSON object : View

Products Affected

opcfoundation

ua_.net_standard_stack

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2024-42512", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42512", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-11T14:49:03.675054Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC Energy Manager PRO V7.2", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC Energy Manager PRO V7.3", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC Energy Manager PRO V7.4", "versions": [{"status": "affected", "version": "V7.4 Update 0", "lessThan": "V7.4 Update 7", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC Energy Manager PRO V7.5", "versions": [{"status": "affected", "version": "V7.5 Update 0", "lessThan": "V7.5 Update 2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMIT V11", "versions": [{"status": "affected", "version": "0", "lessThan": "V11.3", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-02-10T19:15:37.910", "references": [{"url": "https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42512.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled."}, {"lang": "es", "value": "Una vulnerabilidad en PC UA .NET Standard Stack anterior a 1.5.374.158 permite que un atacante no autorizado eluda la autenticaci\u00f3n de la aplicaci\u00f3n cuando la pol\u00edtica de seguridad obsoleta Basic128Rsa15 est\u00e1 habilitada."}], "lastModified": "2026-10-15T01:18:46.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opcfoundation:ua_.net_standard_stack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00E5719E-6F63-4C31-AFC4-D847F0CD75EA", "versionEndExcluding": "1.5.374.158"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}