{"id":"CVE-2024-42513","aliases":["EUVD-2025-5034","GHSA-4rcc-7pg7-f57f","GHSA-7wwr-h8cm-9jf7"],"status":"published","title":"Security Update for the OPC UA .NET Standard Stack","description":"Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00577,"percentile":0.4789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290","CWE-305"],"published":"2025-02-10T00:00:00Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Bindings.Https","fixed_in":["1.5.374.158"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Bindings.Https","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.374.158"}]}]},{"source":"osv","ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Bindings.Https","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.374.158"}]}],"versions":["1.4.364.28-preview","1.4.364.34-preview","1.4.364.40","1.4.365.1-preview","1.4.365.10","1.4.365.2","1.4.365.23","1.4.365.48","1.4.366.31-preview","1.4.366.38","1.4.367.100","1.4.367.39","1.4.367.41","1.4.367.42","1.4.367.64-preview","1.4.367.75","1.4.367.95","1.4.368.27-preview","1.4.368.33","1.4.368.52-preview","1.4.368.53","1.4.368.58","1.4.369.30","1.4.370.1","1.4.370.12","1.4.370.9","1.4.371.41","1.4.371.50","1.4.371.60","1.4.371.86","1.4.371.91","1.4.371.96","1.4.372.106","1.4.372.107","1.4.372.112-preview","1.4.372.116-preview","1.4.372.38-preview","1.4.372.46-preview","1.4.372.56","1.4.372.67-preview","1.4.372.76","1.4.372.91-preview","1.5.368.2-rc0","1.5.368.3-rc0","1.5.368.5-beta","1.5.371.3-beta","1.5.372.1-rc","1.5.372.110-rc2","1.5.372.113","1.5.373.121","1.5.373.3-preview","1.5.374.118","1.5.374.124","1.5.374.126","1.5.374.26-preview","1.5.374.27","1.5.374.33-preview","1.5.374.36","1.5.374.50-preview","1.5.374.54","1.5.374.61-preview","1.5.374.70","1.5.374.78"]}],"products":[{"vendor":"opcfoundation","product":"ua_.net_standard_stack"},{"vendor":"siemens","product":"industrial edge for machine tools (formerly known as \"sinumerik edge\")"},{"vendor":"siemens","product":"simatic braumat"},{"vendor":"siemens","product":"simatic energy manager pro v7.2"},{"vendor":"siemens","product":"simatic energy manager pro v7.3"},{"vendor":"siemens","product":"simatic energy manager pro v7.4"},{"vendor":"siemens","product":"simatic energy manager pro v7.5"},{"vendor":"siemens","product":"simatic ipc diagmonitor"},{"vendor":"siemens","product":"simatic sistar"},{"vendor":"siemens","product":"simatic wincc unified v18"},{"vendor":"siemens","product":"simatic wincc unified v19"},{"vendor":"siemens","product":"simatic wincc v8.0"}],"references":[{"url":"https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42513.pdf","tags":["Vendor Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-858251.html","tags":["web"]},{"url":"https://github.com/OPCFoundation/UA-.NETStandard/security/advisories/GHSA-4rcc-7pg7-f57f","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42513","tags":["advisory"]},{"url":"https://github.com/OPCFoundation/UA-.NETStandard/tree/1.5.374.158","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4rcc-7pg7-f57f"},{"url":"https://github.com/advisories/GHSA-7wwr-h8cm-9jf7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42513.json","tags":["advisory"]},{"url":"https://github.com/OPCFoundation/UA-.NETStandard","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-42513","description":"Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","status":"published","published":"2025-02-10T00:00:00Z","modified":"2026-10-15T00:48:22.708Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2025-5034","description":"Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","status":"published","published":"2025-02-10T00:00:00Z","modified":"2026-10-15T00:48:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:09.754388Z"}],"ghsa":[{"id":"GHSA-4rcc-7pg7-f57f","title":"Security Update for the OPC UA .NET Standard Stack","description":"This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","status":"published","published":"2025-03-03T20:09:54Z","modified":"2025-03-03T20:09:57Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-290","CWE-305"],"updated_at":"2026-11-02T14:38:33.163519Z"},{"id":"GHSA-7wwr-h8cm-9jf7","title":"Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4rcc-7pg7-f57f. This link is maintained to preserve external references.\n\n## Original Description\nVulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","status":"withdrawn","published":"2025-02-10T21:31:37Z","modified":"2025-03-03T20:08:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-290","CWE-305"],"updated_at":"2026-11-02T14:38:33.163519Z"}],"nvd":[{"id":"CVE-2024-42513","description":"Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","status":"published","published":"2025-02-10T19:15:38.023Z","modified":"2026-10-15T01:18:47.157Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:10:44.033107Z"}],"osv":[{"id":"CVE-2024-42513","description":"Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","status":"published","published":"2025-02-10T00:00:00Z","modified":"2026-10-28T02:30:21.072799716Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-4rcc-7pg7-f57f","title":"Security Update for the OPC UA .NET Standard Stack","description":"This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","status":"published","published":"2025-03-03T20:09:54Z","modified":"2025-03-03T20:41:46.914644Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-290","CWE-305"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"GHSA-7wwr-h8cm-9jf7","title":"Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4rcc-7pg7-f57f. This link is maintained to preserve external references.\n\n## Original Description\nVulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.","status":"withdrawn","published":"2025-02-10T21:31:37Z","modified":"2025-03-03T20:26:53.82952Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-290","CWE-305"],"updated_at":"2026-11-02T15:46:41.732368Z"}]}}