Siemens User Management Component (UMC)
Siemens User Management Component (UMC) before V2.11.2 is affected by multiple vulnerabilities where the most severe could lead to a restart of the UMC server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-46285US | — | — | ||
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC N… | ||||
| CVE-2023-46284US | — | — | ||
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC N… | ||||
| CVE-2023-46283US | — | — | ||
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC N… | ||||
| CVE-2023-46282US | medium6.1 | — | ||
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC N… | ||||
| CVE-2023-46281US | high8.8 | — | ||
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC N… | ||||
references
External citations — patches, advisories, analysis.
- SSA-999588: Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2 - CSAF Versionself
- SSA-999588: Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2 - HTML Versionself
- ICS Advisory ICSA-23-348-03 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-348-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (90)
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V14
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V14
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V14
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V14
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V14
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V15.1
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V15.1
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V15.1
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V15.1
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V15.1
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V16
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V16
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V16
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V16
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V16
Currently no fix is planned
- FixedOpcenter Execution Foundation
Update to V2407 or later version
- FixedOpcenter Execution Foundation
Update to V2407 or later version
- FixedOpcenter Execution Foundation
Update to V2407 or later version
- FixedOpcenter Execution Foundation
Update to V2407 or later version
- FixedOpcenter Execution Foundation
Update to V2407 or later version
- FixedOpcenter Quality
Update to V2312 or later version
- FixedOpcenter Quality
Update to V2312 or later version
- FixedOpcenter Quality
Update to V2312 or later version
- FixedOpcenter Quality
Update to V2312 or later version
- FixedOpcenter Quality
Update to V2312 or later version
- FixedSIMATIC PCS neo
Update to V4.1 or later version
- FixedSIMATIC PCS neo
Update to V4.1 or later version
- FixedSIMATIC PCS neo
Update to V4.1 or later version
- FixedSIMATIC PCS neo
Update to V4.1 or later version
- FixedSIMATIC PCS neo
Update to V4.1 or later version
- FixedSINEC NMS
Update to V2.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826954/ - FixedSINEC NMS
Update to V2.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826954/ - FixedSINEC NMS
Update to V2.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826954/ - FixedSINEC NMS
Update to V2.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826954/ - FixedSINEC NMS
Update to V2.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826954/ - FixedTotally Integrated Automation Portal (TIA Portal) V17
Update to V17 Update 8 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V17
Update to V17 Update 8 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V17
Update to V17 Update 8 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V17
Update to V17 Update 8 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V17
Update to V17 Update 8 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V18
Update to V18 Update 3 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V18
Update to V18 Update 3 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V18
Update to V18 Update 3 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V18
Update to V18 Update 3 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V18
Update to V18 Update 3 or later version
- WorkaroundOpcenter Execution Foundation
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundOpcenter Execution Foundation
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundOpcenter Execution Foundation
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundOpcenter Execution Foundation
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundOpcenter Execution Foundation
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
- WorkaroundOpcenter Quality
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundOpcenter Quality
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundOpcenter Quality
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundOpcenter Quality
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundOpcenter Quality
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
- WorkaroundSIMATIC PCS neo
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundSIMATIC PCS neo
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundSIMATIC PCS neo
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundSIMATIC PCS neo
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundSIMATIC PCS neo
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
- WorkaroundSINEC NMS
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundSINEC NMS
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundSINEC NMS
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundSINEC NMS
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundSINEC NMS
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V14
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V14
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V14
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V14
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V14
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V15.1
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V15.1
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V15.1
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V15.1
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V15.1
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V16
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V16
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V16
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V16
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V16
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V17
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V17
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V17
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V17
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V17
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V18
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V18
CVE-2023-46281, CVE-2023-46282: Do not access links from untrusted sources
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V18
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V18
CVE-2023-46283, CVE-2023-46284: If only one UMC server is used, block access to port 4002/tcp e.g. with an external firewall
- WorkaroundTotally Integrated Automation Portal (TIA Portal) V18
CVE-2023-46284, CVE-2023-46285: If only one RT server is used, block access to port 4004/tcp e.g. with an external firewall. If the deployment contains no RT-Servers, block the port in the local firewall.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan