CVE-2024-42513
Security Update for the OPC UA .NET Standard Stack
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Record
CVE-2024-42513- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-305
- Updated
- 2026-11-02
EUVDEUVD-2025-5034
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Record
EUVD-2025-5034- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4rcc-7pg7-f57f
Security Update for the OPC UA .NET Standard Stack
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Record
GHSA-4rcc-7pg7-f57f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-290, CWE-305
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7wwr-h8cm-9jf7
Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4rcc-7pg7-f57f. This link is maintained to preserve external references.
Original Description
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Record
GHSA-7wwr-h8cm-9jf7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-290, CWE-305
- Updated
- 2026-11-02
NVD
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Record
CVE-2024-42513- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-305
- Updated
- 2026-11-02
OSV
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Record
CVE-2024-42513- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-4rcc-7pg7-f57f
Security Update for the OPC UA .NET Standard Stack
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Record
GHSA-4rcc-7pg7-f57f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-290, CWE-305
- Updated
- 2026-11-02
OSVGHSA-7wwr-h8cm-9jf7
Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4rcc-7pg7-f57f. This link is maintained to preserve external references.
Original Description
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Record
GHSA-7wwr-h8cm-9jf7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-290, CWE-305
- Updated
- 2026-11-02
Affected products
- opcfoundation ua .net standard stack
- siemens industrial edge for machine tools (formerly known as "sinumerik edge")
- siemens simatic braumat
- siemens simatic energy manager pro v7.2
- siemens simatic energy manager pro v7.3
- siemens simatic energy manager pro v7.4
- siemens simatic energy manager pro v7.5
- siemens simatic ipc diagmonitor
- siemens simatic sistar
- siemens simatic wincc unified v18
- siemens simatic wincc unified v19
- siemens simatic wincc v8.0
Affected packages
| Package | Affected | Fixed |
|---|---|---|
OPCFoundation.NetStandard.Opc.Ua.Bindings.HttpsNuGet |
before 1.5.374.158 | 1.5.374.158 |
OPCFoundation.NetStandard.Opc.Ua.Bindings.HttpsNuGet |
before 1.5.374.158, plus listed versions 1.4.364.28-preview1.4.364.34-preview1.4.364.401.4.365.1-preview1.4.365.10 Show 45 moreShow less1.4.365.21.4.365.231.4.365.481.4.366.31-preview1.4.366.381.4.367.1001.4.367.391.4.367.411.4.367.421.4.367.64-preview1.4.367.751.4.367.951.4.368.27-preview1.4.368.331.4.368.52-preview1.4.368.531.4.368.581.4.369.301.4.370.11.4.370.121.4.370.91.4.371.411.4.371.501.4.371.601.4.371.861.4.371.911.4.371.961.4.372.1061.4.372.1071.4.372.112-preview1.4.372.116-preview1.4.372.38-preview1.4.372.46-preview1.4.372.561.4.372.67-preview1.4.372.761.4.372.91-preview1.5.368.2-rc01.5.368.3-rc01.5.368.5-beta1.5.371.3-beta1.5.372.1-rc1.5.372.110-rc21.5.372.1131.5.373.121 |
1.5.374.158 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-42513 is a medium vulnerability (CVSS 5.3) in Opcfoundation Ua .net Standard Stack, published February 10, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in OPCFoundation.NetStandard.Opc.Ua.Bindings.Https 1.5.374.158.
References
files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42513.pdf
cert-portal.siemens.com/productcert/html/ssa-858251.html
github.com/OPCFoundation/UA-.NETStandard/security/advisories/GHSA-4rcc-7pg7-f57f
nvd.nist.gov/vuln/detail/CVE-2024-42513
Left out here: 13 versions. The JSON record has them.