Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Siemens User Management Component V2.15 Multiple Vulnerabilities

High

Synopsis

Multiple vulnerabilities exist in Siemens User Management Component V2.15.

CVE-2025-30174 - um.Ris.exe Out-of-bounds Read DoS (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) 

An unauthenticated remote attacker can send an integer with a large value to crash um.Ris.exe. 

CVE-2025-30175 - um.serlib.dll ixstream::ReadString int32 Overflow DoS (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

An unauthenticated remote attacker could send an integer with a large value causing a crash in um.serlib.dll.

CVE-2025-30176 - um.gpslib.dll GpsReadStr Buffer Over-read DoS (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

An unauthenticated remote attacker can send a malformed RISOPEN message. This causes a buffer over-read, which could result in a read access violation DoS.

Solution

Update UMC to V2.15.1.1 or later compatible version.

Siemens also provides the following workarounds: In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. In addition if no RT server machines are used, port 4004 can be blocked completely
 

Disclosure Timeline

February 26, 2025 - Tenable sends disclosure email to Siemens.
February 27, 2025 - Siemens acknowledges disclosure.
March 11, 2025 - Tenable requests status update.
March 25, 2025 - Siemens indicates they will have a fix soon.
March 28, 2025 - Tenable requests date when fix and advisory will be available.
April 8, 2025 - Tenable asks if Siemens plans on publishing a fix with next month's advisories.
April 14, 2025 - Siemens advises they will be publishing an advisory next month.
May 12, 2025 - Siemens advises that they will publish SSA-614723 tomorrow.

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

Tenable Advisory ID: TRA-2025-14
CVSSv3 Base / Temporal Score:
7.5
CVSSv3 Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
SIMATIC PCS neo
SINEC NMS
SINEMA Remote Connect
Totally Integrated Automation Portal (TIA Portal)
User Management Component (UMC)
Risk Factor:
High

Advisory Timeline

May 20, 2025 - Initial release.