Siemens User Management Component (UMC)

Risk Summary

Siemens' User Management Component (UMC) is affected by multiple vulnerabilities that could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition. Siemens has released a new version for User Management Component (UMC) and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

CVEs (4)

Remediations

• In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).
• Currently no fix is planned
• Update to V2.15.1.3 or later version
• Update to V6.0 SP1 Update 1 or later version

Affected Vendors

Affected Products (4)

Affected Sectors

Critical Manufacturing