CVE-2024-42513

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-305

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	Industrial Edge for Machine Tools (formerly known as "SINUMERIK Edge")	< *
Siemens	SIMATIC BRAUMAT	—
Siemens	SIMATIC Energy Manager PRO V7.2	< *
Siemens	SIMATIC Energy Manager PRO V7.3	< *
Siemens	SIMATIC Energy Manager PRO V7.4	>= V7.4 Update 0, < V7.4 Update 7
Siemens	SIMATIC Energy Manager PRO V7.5	>= V7.5 Update 0, < V7.5 Update 2
Siemens	SIMATIC IPC DiagMonitor	< *
Siemens	SIMATIC SISTAR	—
Siemens	SIMATIC WinCC Unified V18	< V18 Update 6
Siemens	SIMATIC WinCC Unified V19	< V19 Update 4
Siemens	SIMATIC WinCC V8.0	< V8.0 Update 3

References

Timeline

Published: Feb 10, 2025
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-425148.1A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to CVE-2024-425159.9Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <CVE-2024-425167.5HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applica CVE-2024-42528.8A vulnerability classified as critical has been found in Tenda i22 1.0.0.3(4687). This affects the function formSetUrlFilterRule. The manipu CVE-2024-425209.8TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl.CVE-2024-425237.2publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData CVE-2024-42539.1A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vu CVE-2024-425319.8Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets CVE-2024-425339.8SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitra CVE-2024-42547.1The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltrat CVE-2024-425439.8TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.CVE-2024-425459.8TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function.