Skip to content
Fencer Vulns
high 8.6

CVE-2024-42512 json

Security Update for the OPC UA .NET Standard Stack

published 2025-02-10 20 mo ago modified 2026-10-15 25 d ago also GHSA-h958-fxgg-g7w3 , EUVD-2025-5035

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

Patch / fix

  • nuget OPCFoundation.NetStandard.Opc.Ua.Core 1.5.374.158
  • Siemens SIMATIC Energy Manager PRO V7.4 V7.4 Update 7
  • Siemens SIMATIC Energy Manager PRO V7.5 V7.5 Update 2
  • Siemens SIMIT V11 V11.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-072-09 updated cvss 7.4

Siemens OPC UA

  • Siemens SIMATIC Energy Manager PRO V7.2 Siemens SIMATIC Energy Manager PRO V7.3
    affected: no fix planned
  • Siemens SIMATIC Energy Manager PRO V7.4 >=V7.4Update0, <V7.4Update7
    affected: fixed in V7.4 support.industry.siemens.com
  • Siemens SIMATIC Energy Manager PRO V7.5 >=V7.5Update0, <V7.5Update2
    affected: fixed in V7.5 support.industry.siemens.com
  • Siemens SIMIT V11 < 11.3
    affected: fixed in V11.3 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
nuget OPCFoundation.NetStandard.Opc.Ua.Core
<1.5.374.158
1.5.374.158

Affected products

  • Siemens SIMATIC Energy Manager PRO V7.2
  • Siemens SIMATIC Energy Manager PRO V7.3
  • Siemens SIMATIC Energy Manager PRO V7.4
  • Siemens SIMATIC Energy Manager PRO V7.5
  • Siemens SIMIT V11

Classification

Weakness
  • CWE-208 Observable Timing Discrepancy
  • CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.