Siemens User Management Component improper input validation causes network denial of service

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an improper input validation vulnerability that could allow an attacker to bring the service into a Denial-of-Service state by sending a specifically crafted message to 4004/tcp. The corresponding service is auto-restarted after the crash is detected by a watchdog.

• Opcenter Execution Foundation: All versions less than V2407 are affected. Siemens directs customers to update to V2407 or a later version.
• Opcenter Quality: All versions less than V2312 are affected. Siemens directs customers to update to V2312 or a later version.
• SIMATIC PCS neo: All versions less than V4.1 are affected. Siemens directs customers to update to V4.1 or a later version.
• SINEC NMS: All versions less than V2.0 SP1 are affected. Siemens directs customers to update to V2.0 SP1 or a later version.
• Totally Integrated Automation Portal (TIA Portal) V14: All versions are affected; Siemens states that no fix is currently planned.
• Totally Integrated Automation Portal (TIA Portal) V15.1: All versions are affected; Siemens states that no fix is currently planned.
• Totally Integrated Automation Portal (TIA Portal) V16: All versions are affected; the advisory history states that no more fixes are planned for this branch.
• Totally Integrated Automation Portal (TIA Portal) V17: All versions less than V17 Update 8 are affected. Siemens directs customers to update to V17 Update 8 or a later version.
• Totally Integrated Automation Portal (TIA Portal) V18: All versions less than V18 Update 3 are affected. Siemens directs customers to update to V18 Update 3 or a later version.

The flaw is in input validation within Siemens User Management Component (UMC), which is integrated into the affected Siemens automation products. The attacker-controlled input is a specifically crafted message sent to 4004/tcp. The supplied attack characteristics indicate that the service is reachable over the network without authentication or user interaction. Processing the message can place the application into a Denial-of-Service state; the advisory does not establish memory corruption or code execution. A watchdog detects the crash and automatically restarts the corresponding service. The message format, specific validation rule, and parser detail responsible for the failure are not disclosed in the available evidence.

• Reachability: The issue can be triggered over the network by sending a message to 4004/tcp on a system where the corresponding service is active.
• Conditions: The record describes exploitation as requiring no authentication, no user interaction, and low attack complexity.
• Result: A specifically crafted message can bring the service into a Denial-of-Service state. The watchdog may then automatically restart the service.
• Status: The supplied record marks public exploit as false, while the Siemens advisory does not document real-world exploitation or name a specific actor. The available evidence does not establish that the issue has been exploited in the wild, but this should not be interpreted as proof that exploitation has not occurred.

The primary technical outcome is loss of service availability when the UMC-related service processes the specifically crafted message. The available data does not indicate an impact to confidentiality or integrity, and it does not establish code execution or privilege escalation. The watchdog may restart the service after a crash, so one interruption may be limited in duration. However, if the endpoint remains reachable, repeated messages could plausibly cause recurring interruptions; that is an inference from the crash and auto-restart behavior, not a behavior directly documented by the advisory.

• Operational disruption: A malicious message can place the UMC service into a Denial-of-Service state, affecting functions that depend on centralized user management or the integrated service.
• Potential scope: Production, quality-management, network-management, and automation-engineering workflows using the affected Siemens products may be interrupted when the service on 4004/tcp is impacted.
• Recovery behavior: The watchdog automatically restarts the service after detecting a crash, which may limit the duration of an individual outage but does not guarantee continuous availability.
• Impact boundary: The available evidence confirms an availability impact only. It does not show that this flaw by itself exposes data, modifies data, or grants additional privileges.

1. Update the affected branches: Upgrade Opcenter Execution Foundation to V2407 or a later version; Opcenter Quality to V2312 or a later version; SIMATIC PCS neo to V4.1 or a later version; and SINEC NMS to V2.0 SP1 or a later version.
2. Update TIA Portal: For the V17 branch, upgrade to V17 Update 8 or a later version. For the V18 branch, upgrade to V18 Update 3 or a later version.
3. Handle branches without a planned fix: For TIA Portal V14, V15.1, and V16, Siemens does not identify a corresponding fix. Apply the network mitigation rather than assuming an unverified fixed release.
4. Restrict the service port: If the deployment uses only one RT server, block access to 4004/tcp with an external firewall. If the deployment contains no RT servers, block the port with the local firewall.
5. Reduce network exposure: Protect network access to the devices with appropriate controls, configure the environment according to Siemens Industrial Security operational guidance, and follow the product manuals.
6. After updating or applying mitigation, verify listeners, firewall rules, and network paths to 4004/tcp.

1. Inventory Siemens systems using UMC, Opcenter Execution Foundation, Opcenter Quality, SIMATIC PCS neo, SINEC NMS, or TIA Portal, and record each installed version for comparison with Siemens' affected branches and fixed releases.
2. Identify hosts that listen on or permit access to 4004/tcp, especially RT servers, and determine which network segments can send traffic to that port.
3. Review external and local firewall rules to confirm that 4004/tcp is open only where necessary and is not reachable from untrusted or unnecessary network zones.
4. Review service, watchdog, and monitoring logs for crashes or automatic restarts that coincide with inbound activity on 4004/tcp. This is consistent with the documented impact, not a Siemens-confirmed IOC.
5. The advisory does not provide a malicious-message signature, packet format, or specific IOC. Absence of a matching log event does not prove that a system is safe.