Siemens User Management Component (UMC)
Siemens' User Management Component (UMC) is affected by multiple vulnerabilities that could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition. Siemens has released a new version for User Management Component (UMC) and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-40798US | — | — | ||
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Manag… | ||||
| CVE-2025-40797US | — | — | ||
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Manag… | ||||
| CVE-2025-40796US | — | — | ||
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Manag… | ||||
| CVE-2025-40795US | — | — | ||
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Manag… | ||||
references
External citations — patches, advisories, analysis.
- SSA-722410: Multiple Vulnerabilities in User Management Component (UMC) - CSAF Versionself
- SSA-722410: Multiple Vulnerabilities in User Management Component (UMC) - HTML Versionself
- ICS Advisory ICSA-25-254-07 JSONself
- ICS Advisory ICSA-25-254-07 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (32)
- MitigationSIMATIC PCS neo V4.1
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V4.1
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V4.1
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V4.1
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V5.0
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V5.0
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V5.0
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V5.0
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V6.0
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V6.0
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V6.0
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationSIMATIC PCS neo V6.0
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationUser Management Component (UMC)
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationUser Management Component (UMC)
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationUser Management Component (UMC)
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- MitigationUser Management Component (UMC)
In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
- No fix plannedSIMATIC PCS neo V4.1
Currently no fix is planned
- No fix plannedSIMATIC PCS neo V4.1
Currently no fix is planned
- No fix plannedSIMATIC PCS neo V4.1
Currently no fix is planned
- No fix plannedSIMATIC PCS neo V4.1
Currently no fix is planned
- No fix plannedSIMATIC PCS neo V5.0
Currently no fix is planned
- No fix plannedSIMATIC PCS neo V5.0
Currently no fix is planned
- No fix plannedSIMATIC PCS neo V5.0
Currently no fix is planned
- No fix plannedSIMATIC PCS neo V5.0
Currently no fix is planned
- FixedSIMATIC PCS neo V6.0
Update to V6.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000357/ - FixedSIMATIC PCS neo V6.0
Update to V6.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000357/ - FixedSIMATIC PCS neo V6.0
Update to V6.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000357/ - FixedSIMATIC PCS neo V6.0
Update to V6.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000357/ - FixedUser Management Component (UMC)
Update to V2.15.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109991261/ - FixedUser Management Component (UMC)
Update to V2.15.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109991261/ - FixedUser Management Component (UMC)
Update to V2.15.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109991261/ - FixedUser Management Component (UMC)
Update to V2.15.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109991261/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan