# CVE-2024-49775: Unauthenticated Heap-Based Buffer Overflow in Siemens User Management Component (UMC) Enables Remote Code Execution

> Siemens disclosed CVE-2024-49775, a heap-based buffer overflow (CWE-122) in the shared User Management Component (UMC) used across SIMATIC PCS neo, TIA Portal, SINEC NMS, and the Opcenter MES product line. An unauthenticated remote attacker can send crafted input to the network-exposed UMC service to execute arbitrary code, with no user interaction required (CVSS v3.1: 9.8, CVSS v4.0: 9.3). TIA Portal V16 and SIMATIC PCS neo V4.0 have no fix planned and must rely permanently on firewall-based port mitigations.

- **Published:** 2024-12-16T00:00:00Z
- **Last reviewed:** 2024-12-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2488
- **ID:** TL-2026-2488
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-49775, CVE-2024-33698

## Description

CVE-2024-49775 is a critical, unauthenticated, remotely exploitable heap-based buffer overflow (CWE-122) discovered by Tenable in the User Management Component (UMC), the shared authentication/authorization service embedded across a wide swath of Siemens' industrial engineering and manufacturing-execution software: SIMATIC PCS neo (DCS engineering/operations client), TIA Portal (PLC/automation engineering suite), SINEC NMS (network management), and the Opcenter Execution Foundation/Intelligence/Quality/RDnL manufacturing-execution-system (MES) modules.

Because UMC is the component Siemens itself designates as responsible for centralized user authentication across these products, a memory-corruption bug in it is disproportionately significant: successful exploitation does not merely compromise one application instance, it compromises the trust anchor that gates access to engineering and process-control tooling used to program and operate PLCs and DCS controllers. Tenable's technical naming ("um.atbipc.dll") ties the flaw to UMC's inter-process-communication handling, consistent with the vulnerability being reachable over UMC's own network listener rather than requiring local access.

CVSS v3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and v4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) both reflect network attack vector, low attack complexity, zero privileges, zero user interaction, and full confidentiality/integrity/availability impact -- the textbook profile of an unauthenticated, wormable-class RCE primitive in an OT-adjacent environment.

Tenable privately disclosed the flaw to Siemens on October 7, 2024. Siemens initially targeted a December 12, 2024 patch, requested an extension to January 6, 2025, then released the fix and Security Advisory SSA-928984 unexpectedly early on December 16, 2024; Tenable's TRA-2024-49 and CISA's ICSA-24-354-04 followed the next day. Patched builds exist for Opcenter Execution Foundation/Intelligence (V2501.0001+), Opcenter Quality (V2512+), Opcenter RDnL (V2410+), SIMATIC PCS neo V4.1 (Update 3+) and V5.0 (Update 1+), and SINEC NMS / TIA Portal V17-V19 (via UMC V2.15.1.1+). Critically, TIA Portal V16 and SIMATIC PCS neo V4.0 have NO fix planned at all -- Siemens' only guidance for those lines is to firewall UMC's network ports (4002/tcp, and 4004/tcp where no RT server machines are deployed), a permanent compensating control rather than a remediation.

As of this research (September 2026), CVE-2024-49775 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no verified public proof-of-concept or exploit code has surfaced; both Siemens and CISA describe no known exploitation in the wild. This is a sibling disclosure to the earlier CVE-2024-33698 (also a UMC heap-based buffer overflow, publicly disclosed September 10, 2024 via CISA ICSA-24-256-03), indicating the shared UMC codebase has now had at least two independently discovered unauthenticated heap-overflow RCE bugs within a single vendor-disclosure cycle -- a pattern worth flagging for defenders auditing UMC-dependent deployments regardless of which specific CVE they have patched.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1556 Modify Authentication Process
- T0819 Exploit Public-Facing Application
- T0822 External Remote Services
- T0859 Valid Accounts

## Sources

- [SSA-928984: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)](https://cert-portal.siemens.com/productcert/html/ssa-928984.html)
- [ICSA-24-354-04: Siemens User Management Component](https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-04)
- [TRA-2024-49: Siemens User Management Component um.atbipc.dll Heap-based Buffer Overflow](https://www.tenable.com/security/research/tra-2024-49)
- [CVE-2024-49775 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-49775)
- [ICSA-24-256-03: Siemens User Management Component (UMC) - related prior UMC heap-overflow disclosure (CVE-2024-33698)](https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-03)
- [CVE-2024-49775: Siemens UMC Component RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2024-49775/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2488