PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-42512 Siemens CVE debrief

CVE-2024-42512 is a Siemens-disclosed authentication bypass affecting the OPC UA .NET Standard Stack before version 1.5.374.158. The issue is conditional: it applies when the deprecated Basic128Rsa15 security policy is enabled, and the CISA CSAF advisory maps it to multiple Siemens products including SIMATIC Energy Manager PRO V7.2-V7.5 and SIMIT V11. Updates are available for some affected products, while Siemens lists no fix planned for SIMATIC Energy Manager PRO V7.2 and V7.3.

Vendor
Siemens
Product
SIMATIC Energy Manager PRO V7.2
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-11
Original CVE updated
2026-01-14
Advisory published
2025-03-11
Advisory updated
2026-01-14

Who should care

OT/ICS operators, Siemens product owners, and system integrators using affected Siemens products that rely on OPC UA connectivity, especially if Basic128Rsa15 is enabled anywhere in the environment.

Technical summary

The vulnerability is an authentication bypass in the OPC UA .NET Standard Stack prior to 1.5.374.158. According to the advisory description, an unauthorized attacker can bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled. Siemens' CSAF advisory ties the issue to affected product versions including SIMATIC Energy Manager PRO V7.2-V7.5 and SIMIT V11, with vendor remediation paths varying by product.

Defensive priority

High. The issue can enable unauthorized access, but exposure depends on the deprecated Basic128Rsa15 policy being enabled. Prioritize any internet-exposed or segmented-by-trust OPC UA deployments, then verify whether affected Siemens products are present and whether vendor fixes are available for the installed versions.

Recommended defensive actions

  • Inventory Siemens products that use the OPC UA .NET Standard Stack and confirm whether any instance has Basic128Rsa15 enabled.
  • Apply Siemens remediations where available: update SIMIT V11 to V11.3 or later, SIMATIC Energy Manager PRO V7.4 to Update 7 or later, and SIMATIC Energy Manager PRO V7.5 to Update 2 or later.
  • For SIMATIC Energy Manager PRO V7.2 and V7.3, track Siemens guidance closely because the advisory states no fix is currently planned; use compensating controls and isolation.
  • Disable or retire deprecated Basic128Rsa15 wherever operationally possible, and prefer stronger supported security policies.
  • Restrict network access to affected OT assets and monitor for unexpected authentication activity on OPC UA services.

Evidence notes

Based on the CISA CSAF advisory ICSA-25-072-09 and Siemens ProductCERT advisory SSA-858251, published 2025-03-11 and republished by CISA on 2026-01-14. The source revision history notes a June 10, 2025 update adding a fix for SIMIT V11. The advisory states no fix is planned for SIMATIC Energy Manager PRO V7.2 and V7.3. No Known Exploited Vulnerabilities listing was provided in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-42512 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-42512

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-42512 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-42512

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-072-09.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-858251.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-858251.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-09

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.