Skip to content
Fencer Vulns
medium 5.3

CVE-2024-42513 json

Security Update for the OPC UA .NET Standard Stack

published 2025-02-10 20 mo ago modified 2026-10-15 25 d ago also GHSA-4rcc-7pg7-f57f , EUVD-2025-5034

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.

Patch / fix

  • nuget OPCFoundation.NetStandard.Opc.Ua.Bindings.Https 1.5.374.158
  • Siemens SIMATIC Energy Manager PRO V7.4 V7.4 Update 7
  • Siemens SIMATIC Energy Manager PRO V7.5 V7.5 Update 2
  • Siemens SIMATIC WinCC Unified V18 V18 Update 6
  • Siemens SIMATIC WinCC Unified V19 V19 Update 4
  • Siemens SIMATIC WinCC V8.0 V8.0 Update 3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-072-09 updated cvss 9.1

Siemens OPC UA

  • Siemens Industrial Edge for Machine Tools (formerly known as "SINUMERIK Edge") Siemens SIMATIC Energy Manager PRO V7.2 Siemens SIMATIC Energy Manager PRO V7.3
    affected: no fix planned
  • Siemens SIMATIC Energy Manager PRO V7.4 >=V7.4Update0, <V7.4Update7
    affected: fixed in V7.4 support.industry.siemens.com
  • Siemens SIMATIC Energy Manager PRO V7.5 >=V7.5Update0, <V7.5Update2
    affected: fixed in V7.5 support.industry.siemens.com
  • Siemens SIMATIC IPC DiagMonitor
    affected: mitigation, no fix planned
  • Siemens SIMATIC WinCC Unified V18
    affected: mitigation, no fix available
  • Siemens SIMATIC WinCC Unified V19 <V19_Update_4
    affected: fixed in V19, mitigation support.industry.siemens.com
  • Siemens SIMATIC WinCC V8.0 <V8.0_Update_3
    affected: fixed in V8.0 support.industry.siemens.com
  • Siemens SIMATIC BRAUMAT Siemens SIMATIC SISTAR
    not affected: vulnerable code not in execute path

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
nuget OPCFoundation.NetStandard.Opc.Ua.Bindings.Https
<1.5.374.158
1.5.374.158

Affected products

  • Siemens Industrial Edge for Machine Tools (formerly known as "SINUMERIK Edge")
  • Siemens SIMATIC BRAUMAT
  • Siemens SIMATIC Energy Manager PRO V7.2
  • Siemens SIMATIC Energy Manager PRO V7.3
  • Siemens SIMATIC Energy Manager PRO V7.4
  • Siemens SIMATIC Energy Manager PRO V7.5
  • Siemens SIMATIC IPC DiagMonitor
  • Siemens SIMATIC SISTAR
  • Siemens SIMATIC WinCC Unified V18
  • Siemens SIMATIC WinCC Unified V19
  • Siemens SIMATIC WinCC V8.0

Classification

Weakness
  • CWE-305 Authentication Bypass by Primary Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.